Prepare
A PREPARE state is established in the channel for each hop. Two spend paths: COMMIT (preimage) and CANCEL (authorized signature).
Channel mechanics
Mechanics of the three-hop lock
Hash locks without Lightning-style decrementing clocks. Staggered deposits enforce cancellation on the first two hops. A timeout exists only where a customer must act.
Prepare deposits
| Hop | Deposits | Who can CANCEL |
|---|---|---|
| A → B | Alice N, Bob N (1:1) | Bob |
| B → C | Bob N, Carol 3N (staggered) | Carol |
| C → D | Carol N, Dave 0 (HTLC) | Timeout only |
Commit
Dave reveals the preimage. Any party holding it can unilaterally broadcast COMMIT. The secret walks backward: Dave → Carol → Bob.
Cancel
Only the designated party on each hop can sign CANCEL. Without the preimage, CANCEL is the only legal resolution on the first two hops.
Race rule
If a valid CANCEL signature exists, CANCEL takes precedence over COMMIT. A challenge window makes this a deterministic on-chain dispute — not a mempool race.
Deposit lockPreimageSignature
Incentives, not clocks
Carol stakes 3NAs much as Alice and Bob combined. She cannot lock the path without locking an equal claim on herself. If she cannot complete, she cancels promptly.
Bob stakes NEqual to Alice. If Carol refuses or later cancels, Bob is incentivized to unwind A → B.
Dave stakes nothingThe last hop is an HTLC. Carol and Dave choose the timeout — short without trust, or with trust they can extend the duration to avoid congestion attacks.
Governance sits beside the rails
The protocol requires a full-mesh core and is silent on membership. Who is admitted as a router, how capital is posted, how fees are set — that is a separate layer. The rails only assume that every router already has a channel to every other router.