Seven rails. Five assertions each.

Known risk — Slow finality, reorg risk

1. Invoice created

   Amount and address match the order; invoice has an expiry

2. Broadcast

   Transaction accepted to mempool; fee rate above the floor

3. 1 confirmation

   Order stays pending. One confirmation is not settlement

4. 3 confirmations

   Status flips to paid exactly once, even on a replayed webhook

5. Settled

   Ledger row and API response agree on amount, asset and timestamp

Known risk — Instant, but invoices expire

1. Invoice created

   Payment hash unique; expiry short enough to price-protect

2. Route found

   Insufficient liquidity surfaces as a retry, not a failed order

3. In flight

   Checkout holds state, with no double-submit while the HTLC is pending

4. Preimage received

   Preimage verifies against the payment hash before crediting

5. Settled

   Expired-mid-checkout path issues a fresh invoice, not a silent fail

Known risk — Gas, nonces, reverts

1. Quote locked

   Rate held for the quoted window; drift past tolerance rejects

2. Tx submitted

   Nonce sequencing correct; gas estimate survives a busy block

3. Mined

   Receipt status is 1. A mined revert is not a payment

4. Confirmed

   Reorg below the confirmation depth does not credit the account

5. Settled

   Amount credited net of gas, matching the ledger to the wei

Known risk — Token transfer, not native

1. Deposit address issued

   Address derived for this account only; never reused across users

2. Transfer event

   Transfer log parsed from the right contract, not a lookalike token

3. Decimals applied

   Six decimals, not eighteen. The classic off-by-10¹² bug

4. Confirmed

   Zero-value and self-transfer events are ignored

5. Settled

   Credited balance reconciles against the on-chain balance

Known risk — Tokenised commodity

1. Quote locked

   Gold price feed fresh; a stale feed blocks the quote

2. Transfer event

   Fractional units handled, because gold trades in fractions of an ounce

3. Confirmed

   Rounding never favours the house or the customer silently

4. Converted

   Swap to fiat or stablecoin matches the locked quote, fees itemised

5. Settled

   Ledger, statement and API all report the same unit and precision

Known risk — Contract calls and events

1. Call encoded

   ABI encoding matches the deployed contract, not a stale artefact

2. Simulated

   Dry run catches the revert before a real transaction pays gas

3. Executed

   Emitted events carry the values the UI is about to display

4. Access checked

   A non-owner calling a privileged method reverts, every time

5. Settled

   Contract state, event log and our database tell the same story

Known risk — Money leaving. The scary one

1. Payout requested

   Destination address checksum-valid for the chosen chain

2. Address verified

   Unverified address is refused. No exceptions, no override path

3. Approved

   Balance and limits checked at approval, not just at request

4. Broadcast

   A retried request never broadcasts twice for one payout id

5. Settled

   Audit trail records who approved it, when, and to where