Bring-your-own oracle access#

Seesaw does not make an application server authoritative for market outcomes. Native Pyth markets and external zkTLS-based markets through Reclaim Protocol use different access and trust models.

Native Pyth markets#

To create or crank a native market, supply a Pyth Hermes API key. The key is stored only on the device:

• web: @seesaw/key-vault using WebCrypto and IndexedDB;
• mobile: expo-secure-store; and
• CLI: PYTH_API_KEY or PYTH_API_KEY_FILE.

The key is sent only to an allowed Hermes host as an Authorization: Bearer header. Allowed hosts are hermes.pyth.network, hermes-beta.pyth.network, and pyth.dourolabs.app. The apps test a key with GET /v2/price_feeds?query=btc before storing it.

Without a Pyth key, native create and snapshot/expiry cranks are unavailable to that user. Resolution after a valid snapshot does not need the key. Anyone with a valid key may crank; Seesaw offers no lifecycle SLA.

zkTLS-based markets through Reclaim Protocol#

Reclaim application credentials are needed only to ask Reclaim/zkFetch to produce a proof. They are sent to the paired proof runner, not to Seesaw's indexer or transaction relay. A user may instead import a completed schema-V2 envelope from a file, clipboard, QR flow, or another relayer.

The envelope contains the exact serialized proof bytes and public capture metadata. It contains no Seesaw witness signatures. The runner and keeper are untrusted transport: neither can choose an outcome or convert a Reclaim signature into a separately trusted Seesaw claim.

The final transaction:

1. reads an immutable verifier-owned proof buffer;
2. CPIs from Seesaw into the pinned standalone Reclaim verifier;
3. recomputes the complete claim identifier and EIP-191 signing digest;
4. uses the secp256k1_recover syscall to authenticate the attestor against the active governance-approved Reclaim epoch snapshot;
5. binds the signed source request, deployment, program, market, purpose, terminal condition, and template-policy commitments; and
6. creates and consumes a market-scoped receipt in the same transaction as the market transition.

No Ed25519 signature-precompile instruction, Instructions sysvar, Seesaw witness service, or preceding-instruction offset parser is used. Legacy witness packages and tags are rejected.

Supported external source policy#

The V1 adapter supports reviewed Kalshi V3 conditions: definition/open, finalized YES, finalized NO, finalized VOID, left-open halt, and close-time extension. Each condition commits to the exact GET URL, headers, match/redaction rules, normalized source ID, context, and semantic mapping. Polymarket defaults to Gamma HTTPS facts authenticated by Reclaim: open definitions and finalized YES, NO, or VOID payouts. An unsigned browsing response never authorizes settlement. The onchain verifier checks the signed Gamma claim and its market binding; it does not verify Polygon consensus.

Proofs must be timely under the onchain market policy and active epoch window. Outcome and fact commitments are derived onchain from the matched condition, not accepted from top-level extracted values or caller arguments.

Trust boundary#

An accepted transaction proves that the active governance-approved Reclaim attestor signed the exact claim bytes and that Seesaw's reviewed semantic policy matched them for this market. The current V1 snapshot is honestly threshold one; it does not claim a separate Seesaw quorum.

It does not independently verify Google's Confidential Computing attestation, the underlying zkTLS/STWO proof, or the source application's truth. Product copy must state:

Reclaim attestor signatures are verified onchain; Google TEE and underlying zkTLS verification remain offchain.

Operator services#

Keeper daemons and relay-backed routes remain gated by SEESAW_OPERATOR_KEEPERS_ENABLED=1 and SEESAW_KEEPER_ROUTES_ENABLED=1. A Reclaim keeper may relay a valid envelope, but permissionless submission means users are not dependent on that keeper. Proof creation still depends on access to Reclaim or possession of existing valid proof bytes.

Permissionless maintenance that does not need new oracle evidence remains available according to the market state, including external neutral expiry, preallocation cleanup, progress-reserve top-up, and closer rewards. A missing, expired, or compromised Reclaim epoch must fail closed; it is not a reason to infer an outcome or resurrect the witness bridge.

Secret-handling guarantees#

• Secrets never enter React state, props, context, URLs, analytics, crash reports, or persisted relay payloads. Registered secret forms are scrubbed from logs and error boundaries.
• Web vault records use per-record AES-GCM IVs and a non-extractable key. They are cleared from memory on wallet change, page lifecycle transitions, and idle timeout. Same-origin script can still decrypt while the page is open, so XSS and dependency compromise remain relevant threats.
• Mobile records use WHEN_UNLOCKED_THIS_DEVICE_ONLY; absent, locked, and corrupt are distinct fail-closed states.
• Imported Reclaim schema-V2 envelopes are public proof material, not secrets. Pairing tokens are short-lived, wallet/operation-bound capabilities and must not be embedded with application credentials.

Manual QA checklist: device behaviour#

Before a release, verify on physical iOS and Android devices that secure-store records remain locked before first unlock, do not transfer to another device, surface tampering as corrupt, and are actually removed by Forget. Exercise a schema-V2 Reclaim proof import and staged buffer submission with Hermes/JSC—not the Chrome debugger—and confirm no legacy witness or Ed25519-precompile instruction appears in the planned transactions.