Skip to content

⏳ Unilateral Exit

The Unilateral Exit is the third and final path in every Vault. It guarantees that the borrower can always recover BTC on Bitcoin alone, without the DCN, the Coordination Layer, the oracle, or any Surge infrastructure.

This guarantee is enforced by Bitcoin's relative timelock primitive, not by a protocol promise.

Why It Exists

Two of the three Vault paths require coordinated authorization:

  • Repayment needs both the borrower and the DCN.
  • Liquidation needs the DCN (authorized by the Coordination Layer).

If those external systems fail - the DCN goes offline, oracle feeds stop, the Coordination Layer halts - the borrower must still be able to reclaim BTC. That is exactly what the Exit path enforces: after a fixed relative delay, the borrower alone can spend the output.

Script

OP_CHECKSEQUENCEVERIFY   # relative timelock
OP_DROP
<userPubkey> OP_CHECKSIG
  • OP_CHECKSEQUENCEVERIFY (CSV, BIP112) is a relative timelock - the delay counts from the funding input confirmation, not from an absolute block height or wall-clock date.
  • Once the CSV expires, the borrower's Schnorr signature over their userPubkey is the only requirement for a valid spend.

Illustrative Timeline

  • A borrower deposits BTC into a Vault and receives stablecoin.
  • Later, external systems become unavailable (for example, the DCN and Coordination Layer stop operating).
  • Once the relative CSV delay has fully elapsed, the borrower creates a spend that reveals the Exit path and broadcasts it.
  • The borrower recovers BTC directly from Bitcoin script enforcement, without requiring any counter-party coordination.

Unilateral Exit Tool

If you want to execute this path in practice, Surge hosts a public recovery app at exit.surge.credit.

The tool can also be self-hosted from the surge-vault-exit-tool repository.

  • Derives your vault deterministically from wallet key + credit address.
  • Shows exit readiness per UTXO based on confirmations and CSV timelock progress.
  • Builds an Exit PSBT for wallet signing and on-chain broadcast.
  • Keeps recovery non-custodial since keys remain in your wallet.

Properties

  • No counter-party dependency after expiry. The DCN, the oracle, and the Coordination Layer can all be permanently dead and the Exit leaf still spends.
  • Relative, not absolute. Every deposit gets its own CSV clock from its funding tx confirmation.
  • Script-enforced, not trust-enforced. There is no admin key, no governance override, and no upgrade path that can weaken this leaf for an already-funded UTXO. To change the Exit behaviour for future vaults, the vault template itself would have to be re-deployed; existing UTXOs retain the scripts they committed to at creation.