Apsis is operator-run. Custody of float, quoting, and execution all sit with a single first-party operator. This is a deliberate trade: it is what removes the message-passing wait and the guardian set, and it means the guarantees are narrower than a trust-minimized bridge’s. Be accurate about this with your users. The protocol does not claim to be trustless.

​
What the operator controls

  • Float on every chain, held in the inventory vault it owns.
  • Pricing: the spread, the accepted size band, and which chains and tokens are quotable.
  • Execution: when fulfillments, refunds, and relayed gasless deposits are submitted, and at what gas price.
  • The owner keys that can pause the contracts, withdraw float, change the executor, aggregator, and voucher-signer allowlists, and upgrade the router. The router is UUPS-upgradeable; the inventory vault is not.

​
What the contract enforces

These hold regardless of operator intent, and they are the reason a compromised executor is not a compromised vault.

​
Invariants for integrators

  • The quote hash binds the deposit. A deposit that does not match the stored parameters is refunded, never fulfilled at a different price.
  • One active order per quote. Enforced by a unique index. A duplicate deposit against the same hash does not produce two payouts.
  • Terminal states are final. fulfilled, refunded, refund_skipped, deposit_missing, refund_failed, and unsupported_deposit do not change afterwards.
  • Executors are interchangeable. Any executor can serve any order; removing one degrades nothing but coverage of its own in-flight transactions.

​
Failure modes worth designing for

The last row is the one to weigh. Funds in flight depend on the operator continuing to run. Size your exposure accordingly and prefer smaller, faster settlement over batching value into single large orders. See Security for the contract surface and audit status.