Principles
Corridor never holds the keys
Vaults sign through the customer’s own KMS, HSM or MPC provider behind one interface. Corridor sends digests and receives signatures. See Keys and signers.
Read-only needs no keys at all
A pilot watches addresses and matches records. Nothing can move.
No single key moves a shielded vault
Each vault’s spend authority is a FROST group key split three ways. Any two of customer approver, customer finance and Corridor can sign; one alone is refused.
Disclosure is scoped
A viewing key reveals one customer’s vault for one period, read-only. It can verify; it cannot spend.
Partner input is authenticated
Webhooks are HMAC-signed, time-bounded and compared in constant time. Forgeries get a 401 and change nothing.
Money moves exactly once
Funding, deliveries and broadcasts are recorded durably before and after they happen, so retries find them instead of repeating them.
Keys
Keys are never committed, printed or sent anywhere. The public console snapshot scans its output for every value in
.env.local and every secret file under .keys/, and refuses to publish on a match.
Webhook verification
Partner deliveries follow Paj’s scheme, which Corridor also uses for its own mock partner:- The timestamp must be within 5 minutes.
- The
v1=value is compared in constant time (timingSafeEqual); during a secret rotation a header may carry several schemes, and any validv1passes. - Each order status is stored once; redeliveries are acknowledged without effect.
Exactly-once funding
A partner payout records its partner order and the funding transaction (partner_order_links) durably. If a worker crashes after opening an order, the retry reuses it; if it crashes after funding, the retry sees the funding reference and does not send again. A partner failure after funding stops at manual_review, because the money is at the partner until its refund is confirmed.
Shielded vault signing
corridor-frost only signs spends that belong to its vault. For each unsigned Ironwood action in a PCZT it checks that the randomized key rk equals ak + [alpha]G for the vault’s group key ak, then runs both FROST rounds rerandomized by alpha, aggregates, and verifies the RedPallas signature against rk before applying it. A signer set below the threshold is refused. See FROST.