The Escape Hatch provides an emergency withdrawal path from the Trading Gateway Contract. If the integrity of matching or ledger accounting is in question, validators can vote to halt trading and activate exit-only mode.
In this mode, users withdraw eligible funds against the last verified recovery state. The withdrawal path operates through contracts on Polyester Chain, without requiring the normal matching engine to continue operating.
Entering exit-only mode
Validators run their own verifier nodes, review matching and ledger evidence, and verify balance checkpoints. A protocol-defined quorum authorizes the transition to exit-only mode.
The Trading Gateway Contract stops admitting new trading activity and new transfers into Trading. Order matching halts, and the recovery process accounts for open orders, reservations, and pending movements. Polyester Chain remains operational so valid emergency withdrawals can be processed.
Anyone can run a verifier and report a reproducible discrepancy. Activating exit-only mode requires the validator quorum, rather than a single operator's report.
Private balance checkpoints
PolyEngine periodically commits a cryptographic summary of private account balances to Polyester Chain. Zero-knowledge proofs let validators verify that a checkpoint satisfies the defined accounting and authorization rules without publishing individual balances or account trading histories.
The design gives each account access to the private evidence needed to prove its own withdrawal entitlement. Recovery evidence must remain available independently of the trading service. A balance commitment alone is not enough to enable an exit.
These checkpoints supplement PolyEngine's immutable ledger. Individual fills continue to settle off-chain.
Withdrawing during recovery
Exit-only mode fixes the accepted recovery checkpoint for emergency claims. An account proves ownership and its eligible balance against that state, then authorizes the Trading Gateway Contract to release the corresponding funds to its Funding Account.
The recovery state reconciles completed deposits, withdrawals, and other balance movements. Pending obligations and previously paid claims are accounted for before funds are released, so an old balance cannot be withdrawn twice. Activity after the last checkpoint needs reconciliation, so the latest interface balance is not automatically the emergency claim amount.
Emergency claims are enabled only in exit-only mode. Proving one claim does not require exposing every account's balance. The resulting on-chain transfer can still reveal its amount and destination.
External withdrawals continue through Zipper, with its route availability, validator approvals, and custody controls.
Returning to normal operation
Validators vote to resume normal mode after the incident is resolved and recovery state is verified. Completed exits and remaining claims must be reconciled before trading restarts, so withdrawn funds cannot reappear as spendable Trading balances.
Both transitions follow the protocol's configured quorum rules. Public verification is open to anyone. Recovery control is distributed across the authorized validators.
