💰 Repayment Path
The Repayment path is the cooperative closure path of a Vault. It releases the borrower's BTC once the stablecoin debt is settled. There is no bridge, wrapped asset, or custodial hand-off - only a Bitcoin spend that becomes valid when both the borrower and the DCN sign against the path bound to this specific position.
How It Works
- Debt reduction. The borrower repays stablecoins (e.g. USDC) to the protocol via
VaultManager.repay(...)(or the gasless EIP-3009 variantrepayWithERC3009). The on-chain ledger updatesdebtUsdfor the position. - Release authorization. Once the on-chain ledger reflects the repayment and the position is healthy, the Relayer requests a Repayment-leaf spend for a proportional BTC amount; the DCN's per-signer validators independently confirm the on-chain state before participating.
- Co-signing. The DCN runs a Lin24 threshold Schnorr signing session to produce the
loanPubkeysignature, and the borrower's wallet produces theuserPubkeysignature. The signatures are assembled into the Repayment witness. - Full closure. When
debtUsd == 0, the whole UTXO can be spent. BTC is returned to the borrower's withdrawal address in a single transaction.
Script
<vaultId> # 32-byte vault commitment
OP_DROP
<userPubkey> OP_CHECKSIG
<loanPubkey> OP_CHECKSIGADD
OP_2
OP_NUMEQUAL
The leading <vaultId> OP_DROP is a commitment, not a runtime check - it forces the leaf (and therefore the taptree, the Taproot address, and the script tree root) to be unique to this position, so a valid witness for one Vault cannot be replayed against another.
The final OP_2 OP_NUMEQUAL requires exactly two valid signatures - both the borrower and the DCN aggregate key must sign. Neither side can close the Vault without the other via this path.
Properties
- User custody preserved. The DCN cannot use Repayment to move BTC without the borrower's signature.
- DCN attestation preserved. The borrower cannot close the vault without the DCN's signature, which is only produced after the Coordination Layer confirms the repayment.
- BIP340-compatible signature component. The DCN authorization signature itself is standard Schnorr.

