I own the contract layer: settlement engine and its economics, blank repo to mainnet

At Portal to Bitcoin I own the EVM contract layer, and I architected all of it, not just the settlement path but the whole economic system wrapped around it. Blank repo to mainnet: 15+ contracts across Ethereum and Portal chain, TGE in September 2025, full launch in November 2025, zero exploits since.

Context#

Portal to Bitcoin is a $110M+ funded noncustodial settlement protocol between Bitcoin and EVM chains: trustless BTC to EVM with no bridge operator, no wrapped assets, users holding their own keys through the entire flow. That's the hard version of the crosschain problem.

But moving value is only half of a protocol like this. The other half is economics, who stakes, what gets slashed, how honest behavior is made the profitable move for everyone touching the system, how liquidity, fees, and multitoken balances are accounted for and how assets and chains get registered in the first place. That second half is the same class of machinery that sits under any serious onchain venue: a DEX, a perps exchange, an RWA settlement rail, an onchain agent that moves funds. It happens to be settlement here, but the problem is onchain systems design with real money and adversarial counterparties on both sides.

When I came in there was early AMM code and little else. I owned everything from there.

What I designed and built#

I own the EVM side. The architecture, the security posture, and the hard calls were mine, and I re-architected the system from scratch rather than refactor the legacy code, into a dual chain ecosystem: 4 contracts on Ethereum, 11 on Portal chain. It divides into two halves I own equally.

The settlement engine. A hash timelocked (HTLC) atomic settlement core, with asymmetric timeout calibration because Bitcoin counts blocks and the EVM counts seconds and a naive symmetric window is exploitable. ERC-6909 multitoken accounting underneath it, so balances settle per session instead of per trade. Asset and chain registries so new markets and new chains onboard as data, not redeploys. And the onchain matching engine that replaced the inherited AMM, that reversal carries enough weight to be its own case study.

The economic system. Validator staking and slashing. The rewards and penalties incentive layer, the mechanism that makes acting honestly the dominant strategy not just for validators but for the users themselves, so a counterparty who stalls or deviates loses more than they could gain. Liquidity management and the fee mechanics that fund and balance the whole thing. This is the part most people picture as "someone else's job." On this protocol it was mine, and it's the part that's most transferable: it's mechanism design against economic actors, which is the same problem whether the venue clears BTC swaps, perps, or tokenized assets.

Every deployment and operational transaction runs through Gnosis Safe batch scripts. No single key ever touched mainnet state.

The calls that mattered#

Make dishonesty unprofitable for users, not just validators. The easy version of an incentive system polices the operators and trusts the users. Against Bitcoin's ten minute confirmation window, that leaves a free option on the table: a user who can walk away after the price moves is the exploit. I designed the penalty side to bind the users too, so completing the trade honestly is always the cheaper path. Getting the whole set of actors incentive compatible, not just the ones with a stake bond, is what a settlement protocol lives or dies on.

Asymmetric timeouts, because two chains keep different time. The HTLC timeout on the Bitcoin leg and the EVM leg can't be equal; if they are, whoever moves second can grief the party who moved first. Calibrating that asymmetry correctly is the difference between an atomic swap and a way to lose funds.

AMM out, onchain orderbook in. The inherited AMM didn't fit BTC liquidity dynamics or the settlement model, so I led the reversal to an onchain orderbook and built the matching engine that made it affordable. The full argument and the gas work are a case study of their own; the point here is that it was an architecture call I made and then had to make cheap.

External adversarial review as the gate. I made external adversarial review the release gate rather than a formality, and led the full audit lifecycle, scoping through remediation and verification: 6 high/medium findings, all resolved within 24 hours. Underneath it sat 95%+ coverage with fuzz and invariant testing on every production contract.

Outcomes#

• TGE shipped September 2025 with zero critical issues; full protocol launched on Ethereum mainnet and Portal chain in November 2025.
• 15+ contracts live across two chains, the settlement engine and its entire economic system, on a codebase I own.
• Zero exploits since launch. That's a track record, not a proof, and I'm happy to walk through exactly how it was earned: the incentive design, the timeout calibration, the test suites, and the audit trail behind it.

What I'd carry into the next system isn't "settlement." It's the ability to own an onchain protocol's contract layer, the mechanism, the accounting, the security posture, and keep it standing under real money from blank repo to mainnet.

Live artifact#

Portal Token (PTB) on Ethereum mainnet is the publicly visible piece of the deployment.