Canton Swap Engine
A non-custodial cross-chain settlement engine built for Interstice Digital, an institutional fintech platform. Atomic swaps between the Canton Network and Ethereum, engineered so the operator never holds, moves, or can interfere with a counterparty's funds.
Overview
The Canton Swap Engine lets institutional counterparties exchange Canton Coin for Ethereum-native assets (ETH and USDC) in both directions, without either side ever trusting the other, or the platform, to hold their money. Settlement is enforced entirely by audited smart contracts on two independent blockchains, bound together by a shared cryptographic secret.
The mechanism is a Hash Time-Locked Contract (HTLC). Each party locks their asset on its own chain against the same hashlock; revealing the secret to claim one leg mathematically unlocks the other. If either side walks away, both legs refund automatically once their timelocks expire. No intermediary custody, no settlement agent, no counterparty credit risk. The trade either completes atomically or unwinds cleanly.
The system spans a DAML smart-contract suite on the Canton Network (integrating the CIP-56 token standard and Splice Amulet), a Solidity HTLC on Ethereum built and tested with Foundry, a TypeScript orchestration service that coordinates the two chains without ever taking custody, and a Next.js institutional portal for onboarding, quoting, and settlement. The entire platform is engineered so the operator never takes custody of counterparty funds, keeping it outside the regimes that gate custodial venues moving institutional value across chains.
Delivery
The engagement ran from March to June 2026. Amplir embedded a lead engineer who worked shoulder-to-shoulder with Interstice Digital's founders and CTO on the cross-chain settlement layer: sole author of the Canton Coin settlement adapter, and a major contributor to the HTLC contracts on both chains, the SDK, the orchestration service that coordinates them, and the parts of the web portal that drive settlement. That involvement extended to the platform's architecture, security posture and launch readiness throughout.
The work was unusually deep for its timeline. Cross-chain atomic settlement has a small margin for error: a single mistake in a signatory set, a timelock ordering, or a fee path can turn a non-custodial venue into a regulated custodian, or strand real funds. Delivery therefore ran in tight loops of design, implementation and adversarial review, including a full third-party security audit. Every finding was remediated on-ledger and re-verified before launch.
Amplir integrates AI-assisted development tooling into every stage of delivery. That, combined with deep experience in distributed settlement, smart-contract security and financial regulation, is how a single lead engineer can deliver the kind of work that would traditionally demand a specialist consultancy over a far longer timeline.
System Architecture
Two independent blockchains, bound by a shared secret and coordinated by a service that observes everything and controls nothing.
Technology
The Canton side is a DAML smart-contract suite targeting the Canton Network, integrating the CIP-56 token standard and the Splice Amulet / Canton Coin registry. A registry-agnostic locking interface keeps the core settlement contracts independent of any single asset, with a thin adapter binding Canton Coin's round-stable locked-amulet primitive underneath, so new asset types can be added without reopening the audited core. The suite ships with more than 220 on-ledger test scenarios.
The Ethereum side is a Solidity HTLC built and tested with Foundry: more than 210 unit and fuzz tests, safe ERC-20 transfers, reentrancy guards, a pull-payment fee model, and an allowlist that treats supported tokens as a solvency boundary. Both legs verify the same SHA-256 hashlock so a single preimage settles across chains.
The orchestrator is a TypeScript service on AWS ECS. It matches requests to quotes, prepares unsigned transactions for the counterparties' own wallets to sign, watches both chains for confirmations and re-orgs, and drives the swap lifecycle state machine, all without ever holding a key that can move counterparty funds. It reads Canton via the JSON Ledger API and Ethereum via RPC, and persists coordination state in Supabase / PostgreSQL.
The settlement surface of the institutional portal is a Next.js App Router application with a strict, nonce-based Content Security Policy. Settlement in the browser goes through a prepare-sign-execute path so the user's wallet, not the platform, authorizes every asset movement.
Key Features
A closer look at what made this engagement demanding, and what it delivered.
Atomic Cross-Chain Settlement
A swap settles across two blockchains that have no knowledge of each other, with no trusted party in between. Each side locks its asset on its own chain against the same cryptographic hashlock. The first claim reveals the secret; that revelation is what makes the second claim possible. The trade is atomic by construction: both legs settle, or neither does.
If a counterparty disappears mid-swap, no funds are stuck. Every lock carries a timelock, and the timelocks are ordered so the party who must reveal the secret first can never strand the other. When a timelock expires, the locker reclaims their own asset directly, with no permission required from anyone, including the platform.
Non-Custodial by Design
The single hardest constraint on the project was regulatory: the platform must never hold, control, or be able to redirect a counterparty's funds. On Canton, that means the operator is never a signatory on any contract holding counterparty assets, only an observer. On Ethereum, it means the contract has no sweep, no admin withdrawal, and a pause that can never block a user from refunding.
This property was enforced structurally and verified continuously. Funds move directly from locker to claimant on each chain; the platform's party never appears as an owner in the asset path. Fees are collected inline at the moment of successful settlement and never on a refund. The result is a venue that provides infrastructure and coordination, not custody. That distinction is what the entire design is built to preserve.
Security-Audited, Remediated End to End
The settlement contracts went through a full third-party security audit. Every finding was remediated on-ledger and re-verified before launch. That included a subtle class of bug where a locked asset could, under specific conditions, be claimed without revealing the swap secret, or a hashlock could be substituted between quote and lock.
Each fix was implemented at the contract level with a dedicated regression test, not patched around off-chain. The hardening covered custody discipline, hashlock binding, timelock ordering, fee-on- refund prevention and one-lock-per-asset enforcement, closing the exact gaps that separate a robust settlement system from a fragile demo. The test suites grew to more than 440 contract tests across the two chains, pinning these invariants permanently.
Quote-to-Settlement Lifecycle
Institutions submit a request for quote; liquidity providers respond from a dedicated desk; the institution accepts the best price. From there the orchestrator drives a precise settlement state machine: share the hashlock, lock the Canton leg, lock the Ethereum leg, claim in sequence, complete. It advances only on independently verified on-chain confirmations.
The state machine is defensive by default. It gates the critical secret-revealing step behind confirmed finality, tolerates chain re-orgs with explicit grace states, and refuses to advance a swap into a configuration where funds could be lost. Every accepted quote is bound to an on-chain commitment, so what was agreed and what settles are provably the same.
Registry-Agnostic Asset Adapters
Canton assets are archived and recreated on a rolling schedule, which would ordinarily leave a lock pointing at a contract that no longer exists. Rather than special-case Canton Coin, the settlement core depends on a small, registry-agnostic locking interface; a dedicated adapter binds Canton Coin's round-stable locked primitive beneath it.
The audited settlement core never needs to change to support a new asset; a new adapter is written alongside it. That same seam is what makes the roadmap tractable: additional chains and tokenised assets plug into the existing, proven settlement machinery instead of forking it.
The Canton Coin settlement adapter was designed and written entirely by Amplir. It is the piece that binds the audited core to the live Canton Coin registry, and the template every future asset integration follows.
Results
The platform reached production in July 2026 with a working non-custodial settlement path across the Canton Network and Ethereum, in both directions, for ETH and USDC. The settlement contracts on both chains went through a full third-party security audit, with every finding remediated and re-verified, and are backed by more than 440 smart-contract tests.
The architecture holds the non-custodial property structurally, not by convention: the operator is never a signatory on counterparty assets, never a hop in the asset path, and holds no key that can move a counterparty's funds. Fees accrue only on successful settlement. The registry-agnostic core means new assets and chains extend the audited machinery rather than reopen it.
The result is institutional-grade cross-chain settlement infrastructure: the kind of system where a single subtle error moves real money or triggers a licensing regime. It was delivered, audited and shipped, and is live today at intersticedigital.io.
Building something at this level?
Whether it's blockchain settlement, smart-contract security, cross-chain infrastructure, or any system where correctness is non-negotiable, we deliver enterprise-quality software, end to end.
Get in touch