Transfusion
Deposit on any chain, withdraw on any chain. One balance, no bridging.
Core Insight
ICP's threshold cryptography gives the canister native signing keys for Bitcoin, Solana, Ethereum, and every supported chain. Transfusion doesn't bridge assets — it controls real addresses on every chain directly and signs transactions via subnet consensus.
The Problem
DeFi is multi-chain, but moving assets between chains is painful:
| Current Approach | Problem |
|---|---|
| Bridges | Slow, expensive, security risks, wrapped tokens |
| Chain-bound balances | User handles bridging manually |
| Treasury model | Requires platform capital, doesn't scale |
Users want CEX-like simplicity — deposit anywhere, withdraw anywhere — with DEX security.
How It Works
User balances are chain-agnostic. The vault holds real assets on every supported chain and fulfills withdrawals from whichever chain has liquidity:
Solvency invariant: Sum of vault holdings across all chains ≥ sum of all user balances. Always.
Deposit Flow
The user sends assets to a vault address on their preferred chain. The canister detects the deposit and credits their unified balance. From that point, the user's USDC has no chain identity.
Deposit minimums apply per chain to prevent dust attacks and cover gas costs for eventual rebalancing:
| Chain | Minimum Deposit |
|---|---|
| Bitcoin | 0.001 BTC |
| Ethereum | 0.01 ETH |
| Solana | 0.1 SOL |
| ICP | 1 ICP |
| USDC (any chain) | 10 USDC |
Deposits below the minimum are held until the cumulative balance exceeds the threshold, then processed automatically.
Address verification: Before sending funds, users can verify that a deposit address is genuinely controlled by the vault canister. The canister provides a signed attestation of each generated address — verifiable on-chain or via the SDK — so users never have to trust a URL alone.
Withdrawal Flow
If the vault has enough on the target chain, the withdrawal is instant — the canister signs a transaction directly via threshold cryptography. No bridge, no confirmation delays beyond the target chain's finality.
Withdrawal timing by path:
| Path | Timing | Details |
|---|---|---|
| Vault-direct (liquidity available) | Target chain finality only | ~13s Solana, ~3min Ethereum, ~20min Bitcoin |
| LP-filled (vault short) | Same as above | LP fronts the assets; vault reimburses via rebalancing |
| Rebalance-dependent | 5–30 min | Batched cross-chain transfer; timing depends on transport and target chain |
| Two-hop (e.g., Solana ↔ ICP) | 10–40 min | Sequential: first leg finalizes, then second leg initiates |
Rebalancing
The Core Challenge
Deposits and withdrawals don't always match per chain. If most users deposit on Solana but withdraw to Ethereum, the Solana vault accumulates while Ethereum depletes.
Before rebalancing:
Solana: 800K USDC (80%) ← deposits concentrated here
Ethereum: 150K USDC (15%) ← withdrawals draining this
ICP: 50K USDC (5%)
Target distribution:
Solana: 400K USDC (40%)
Ethereum: 400K USDC (40%)
ICP: 200K USDC (20%)How Rebalancing Works
The canister runs a periodic timer that checks vault distribution against target ratios. When deviation exceeds a threshold, it initiates cross-chain transfers using the optimal transport for each route:
Transport selection follows a decision hierarchy — asset-native protocols first, then ICP-native bridges, then general-purpose messaging layers:
| Route | Transport | Why |
|---|---|---|
| USDC between CCTP-supported chains | Circle CCTP | Native mint/burn — no wrapped tokens, zero slippage. Supports Ethereum, Solana, Arbitrum, Base, and ~9 chains |
| Ethereum ↔ ICP | ckBridge | ICP's native Ethereum integration (ckUSDC, ckETH). Secured by ICP consensus, no external bridge |
| Cross-chain (non-USDC, general) | LayerZero V2 | 90+ chains (EVM, Solana, Aptos, Sui, TON). OFT token standard, configurable DVN security stack |
| Cross-chain (compliance-critical) | Chainlink CCIP | 70+ chains, SOC 2 / ISO 27001 certified, oracle-backed verification. Preferred for institutional flows |
| Solana ↔ ICP | Two-hop via Ethereum | No direct bridge protocol; canister orchestrates CCTP (Solana → Ethereum) + ckBridge (Ethereum → ICP) |
Predictive Rebalancing
Instead of reacting to imbalances after they happen, the canister analyzes historical withdrawal patterns and pre-positions liquidity:
- Friday evening → higher Ethereum demand (historically)
- Weekend → higher Solana demand
- Large deposit on one chain → anticipate eventual withdrawal elsewhere
This moves instant withdrawal rates from ~90% to ~99%.
Intent-Based Settlement
For cross-chain withdrawals where vault liquidity is insufficient, the system uses an intent-based architecture compatible with the ERC-7683 standard:
Three potential fillers compete for each withdrawal:
| Filler | Fee | Speed | When |
|---|---|---|---|
| Vault | 0% | Instant | Liquidity available on target chain |
| LP Pool | 0.05% | Instant | LPs provide from their own inventory |
| External Solver | Market rate | Varies | Uses bridges/DEXs to fill |
Users always get the best available price. The vault doesn't need to maintain perfect distribution — solvers and LPs cover the gaps.
LP Pool
External liquidity providers deposit assets on specific chains and earn yield by filling withdrawal intents:
- LP deposits 500K USDC on Ethereum
- User withdraws 200K USDC to Ethereum, vault is short
- LP fills instantly, earns the fill fee
- Vault reimburses LP from rebalancing within ~20 minutes
LPs earn consistent yield from fill fees. Users get instant withdrawals. The vault stays solvent.
Transfusion as Protocol
Transfusion is not just Vortum infrastructure — it's an independent protocol that any project on any supported chain can integrate for multi-chain settlement.
Design Principle
Transfusion's API is open to integrators across ecosystems. ICP canisters call it directly; Solana programs and EVM contracts interact through on-chain deposit addresses and signed callbacks. No project needs to build its own bridge integrations or manage threshold keys.
API Surface
Transfusion exposes a minimal, composable interface. ICP canisters call these as inter-canister methods; external chains interact via deposit-to-address with callback settlement:
| Operation | Canister Method | External Chain Equivalent |
|---|---|---|
| Deposit | deposit(chain, asset, amount) | Send tokens to vault's chain-specific address |
| Withdraw | withdraw(chain, asset, amount, address) | Canister signs and broadcasts to target chain |
| Balance query | get_balance(account) | Query canister via HTTPS outcall or agent |
| Liquidity check | get_vault_liquidity(chain, asset) | Query canister via HTTPS outcall or agent |
Who Can Integrate
Use cases:
- DEXs & perps — offer multi-chain deposits and withdrawals without building bridge infrastructure
- Lending protocols — accept collateral from any chain, liquidate on any chain
- Yield aggregators — deploy capital across chains through a single integration
- Payments & payroll — pay in one currency/chain, recipient receives on their preferred chain
How each ecosystem integrates:
| Ecosystem | Integration Method |
|---|---|
| ICP canisters | Direct inter-canister calls — tightest integration, lowest latency |
| EVM contracts | Deposit to the vault's chain-specific address; receive signed callback on settlement |
| Solana programs | Same deposit-to-address model; vault monitors via RPC and signs withdrawals via threshold Ed25519 |
Network Effects
Every protocol that integrates increases vault TVL and rebalancing efficiency. More liquidity on each chain means higher instant-withdrawal rates, which attracts more integrators — a compounding flywheel:
| Effect | Mechanism |
|---|---|
| Deeper liquidity | Each integrator's deposits add to the shared pool |
| Lower rebalancing cost | More balanced flows reduce cross-chain transfers |
| Protocol revenue | Settlement fees on every cross-chain operation |
| Competitive moat | Multi-chain liquidity depth is hard to replicate |
The vault becomes a multi-chain liquidity layer — similar to how Circle provides USDC rails, Transfusion provides cross-chain settlement rails that any protocol can build on.
Fee Model
| Scenario | Fee | Details |
|---|---|---|
| Deposit (any chain) | Free | User pays source chain gas; vault charges nothing |
| Same-chain withdrawal | Gas only | ~$0.01–$2 depending on chain |
| Cross-chain, liquidity available | Gas only | Vault fulfills directly |
| Cross-chain, needs rebalance | Gas + rebalance fee | ~$2–5 flat surcharge |
| Cross-chain, LP-filled | Gas + LP fee | ~0.05% of amount |
Users who cause chain imbalance pay for it. Same-chain and pre-balanced cross-chain withdrawals are near-free.
Threshold Signatures
The canister doesn't hold private keys — it participates in a distributed signing protocol with the ICP subnet nodes:
| Chain | Signature Scheme | Status |
|---|---|---|
| Bitcoin | Threshold Schnorr | Production (ckBTC) |
| Ethereum | Threshold ECDSA | Production (ckETH) |
| Solana | Threshold Ed25519 | Production |
| ICP | Native ICRC-1 | Production |
| EVM L2s (Arbitrum, Base, Optimism) | Threshold ECDSA | Same key as Ethereum |
| Dogecoin | Threshold ECDSA | Planned |
| Litecoin | Threshold ECDSA | Planned |
| Bitcoin Cash | Threshold ECDSA | Planned |
| Filecoin | Threshold ECDSA | Planned |
| Cosmos / IBC chains | Threshold ECDSA | Planned |
| TON | Threshold Ed25519 | Planned |
| Stellar | Threshold Ed25519 | Planned |
| NEAR | Threshold Ed25519 | Planned |
| Polkadot | Threshold Ed25519 | Planned |
| Cardano | Threshold Ed25519 | Planned |
| Aptos / Sui | Threshold Ed25519 | Planned |
Every withdrawal is signed by ICP consensus — no single point of failure, no hot wallet, no trusted signer.
Failure Modes
| Failure | Impact | Recovery |
|---|---|---|
| Withdrawal tx fails on-chain | User delayed | Release reservation, unlock balance, prompt retry |
| Vault sync desync | Potential over/under-count | Hourly audit catches discrepancies; halt withdrawals if short |
| Rebalance stuck mid-transfer | Temporary imbalance | Transport-specific recovery: CCTP attestation retry, LayerZero message retry via DVN, CCIP manual execution. Abstraction layer handles automatically |
| Bank run (everyone withdraws one chain) | Partial delays | First users instant, later users offered split/wait options |
| Target chain is down | Can't withdraw there | Offer alternate chains; resume when chain recovers |
Challenges
| Challenge | Approach |
|---|---|
| No direct ICP ↔ Solana bridge protocol | Two-hop via Ethereum for rebalancing, or LP Pool fills instantly |
| Rebalancing costs (gas, bridge fees) | Users causing imbalance pay surcharge; background batching reduces cost |
| Vault balance accuracy | Hourly on-chain audit; multiple RPC endpoints |
| Large withdrawal spikes | LP Pool absorbs spikes; predictive rebalancing prevents most |
| Transport protocol risk | Dependency on multiple bridge protocols; mitigated by transport abstraction layer and automatic fallback routing |
| API abuse / DoS | External protocol integration opens attack surface; mitigated by per-caller rate limits and cycle-cost authentication |
| Dust deposits | Sub-minimum deposits accumulate on vault addresses; auto-processed when cumulative balance exceeds threshold, swept during rebalancing |