Architecture
One contract on Cardano, one hosted API, and a chain follower that tells you when something changed. Everything else is detail.
On chain
The validator
One script and one address, holding the rules for every escrow on the protocol. Almost nothing is compiled into it, because a validator with customer-specific parameters baked in is a validator you cannot change without moving everyone’s money. Ours carries only what it cannot function without.
The escrow
Each escrow is a single output carrying its funds, its terms, and a token minted when it was created. That token is the escrow’s identity. On Cardano an output reference changes every time the escrow moves, so the token is what lets you follow one escrow across its whole life and what stops anything else claiming to be it. It is burned when the escrow ends.
Configuration, and why it cannot reach your money
Fee destinations, caps and minimum sizes live in a separate output the validator reads without consuming. Because it is read rather than spent, every escrow in existence can reference it at once with no contention.
The part that matters is what happens to those values when you create an escrow. They are copied into your escrow’s terms at that moment and frozen there, and every later step reads your copy rather than the live one. There is no configuration change we can make that reaches money already in the contract.
Off chain
Transaction building
You describe what you want. We validate it, build the complete transaction server side, and hand it back unsigned. Signing happens in your wallet, never on our infrastructure, and the transaction you inspect is the transaction that settles.
The chain follower
Rollback aware, watching the one script address, reconciling continuously against chain state. The chain is the source of truth and our database is a cache.
That distinction is load bearing rather than philosophical. It means transactions built by other people are normal traffic rather than anomalies, which is what makes this genuinely open infrastructure instead of infrastructure that is open in principle and brittle in practice.
Events
Signed webhooks, delivered at least once, with idempotency keys. An invariant checker reconciles our projection against the chain continuously, so a disagreement between the two surfaces as an alarm rather than as a support ticket.
Paying someone with an empty wallet
A stablecoin payout on Cardano has to carry a small amount of ada with it. We treat that as the recipient’s first transaction fee rather than as a cost to minimise, because a payment somebody cannot move is not a payment.
A pool-funded sponsor address supplies it. The sponsor is never a required signer on a refund or a fallback path, because anything that must sign an exit path is something that can block one.
Versioning
A change to any rule produces a new script and a new address. Both stay live. We do not migrate funds between versions, ever, for any reason, including our own convenience.
The consequence we accept is that every version we ship is a version we operate permanently, and historical reference scripts stay funded indefinitely. That is the correct trade, because the alternative is a protocol with a function that moves your money without your signature. Nothing is worth having that function.
API versioning is a separate promise and we publish it in full: what counts as a breaking change, how long a version is supported, and how much notice you get. Escrow integrations are expensive to rewrite and you should know the terms before you build.
What we deliberately did not build
No custody. No per-customer contracts. No administrative override. No token, so there is nothing to buy, stake or farm, and the protocol’s economics do not depend on a price.
And no marketplace. We run a bounty platform on Hokan as a customer of our own API, and it holds no privileges over yours. We are not competing with you for your users.