DrawBound issues credit against native Bitcoin with zero wrappers, zero bridges, and zero custodial trust. Every unit drawn is bounded, in real time, by cryptographic proof of the collateral that backs it.
Every BTC credit product today is, at its core, a promise. Wrapped BTC promises 1:1 backing. Custodial lenders promise reserves. Bridges promise redemption. None of these promises are verifiable in real time, and when they break, they break catastrophically.
DrawBound takes a different position: credit issuance is gated by proof, not by operator discretion. The covenant refuses any draw that outruns its attested collateral and health — today that attestation is computed by this server from its vault read, and in strict mode by a signature from an allowlisted oracle key.
That gate is code, not a policy document. What it does not do is enforce issuance inside Bitcoin script: on-chain enforcement lives in the Taurus vault's own unilateral-exit path, not in this app. See the trust budget for exactly what is and is not proven.
The lifecycle of a DrawBound position. Each step is deterministic; each transition is provable.
Deposit native BTC into a non-custodial vault on Bitcoin L1. The collateral never leaves mainchain; it is never wrapped, never bridged.
A cryptographic attestation of the vault state is generated and broadcast. The proof binds the collateral to a specific moment in Bitcoin history.
Credit is issued on the execution layer, but only up to the bound defined by the live proof. Draw attempts beyond the bound are rejected at the protocol level.
Repay, rebalance, or close. Proof refreshes on every state transition, reconciling outstanding credit against current collateral continuously on-chain.
Traditional credit systems audit after the fact: a lender says "trust me, I have the reserves," and a quarterly attestation attempts to verify the claim after the credit has already been issued.
DrawBound inverts the order. The proof is generated before the credit is drawn, and the draw gate refuses to exceed it — no draw is approved while the covenant is frozen, stale, over-limit, or under-collateralized. There is no after-the-fact reconciliation, because the gate runs on every issuance.
Be precise about the boundary: the gate is a check on this server (or on a signature from an allowlisted oracle). The on-chain consequence of a refusal is that the corresponding credit transition is never signed. The strongest on-chain guarantee is the Taurus vault's own unilateral-exit path, which DrawBound does not replace.
// DrawBound issuance: proof is the bound function draw(uint256 amount) external { Proof.Attestation memory att = proof.current(); // proof must be live: stale proof halts issuance require( block.timestamp - att.timestamp < FRESHNESS, "proof stale" ); // the bound: credit cannot exceed verified collateral uint256 bound = (att.collateral * LTV) / BASIS; uint256 projected = positions[msg.sender].drawn + amount; require( projected <= bound, "credit cannot outrun proof" ); positions[msg.sender].drawn = projected; emit Drawn(msg.sender, amount, bound); }
Collateral stays on Bitcoin mainchain. No wBTC, no tBTC, no synthetic representation. Your sats never leave L1.
The credit ceiling is not a parameter, it is a function of the live proof. Issuance beyond the bound is structurally impossible.
No custodian holds your keys or your BTC: the browser generates an ephemeral signing key that never leaves the device, and the vault's own script controls access. Note that in live mode a credit transition still requires a transaction this server broadcasts, signed by the operator.
Proofs refresh continuously as Bitcoin blocks confirm. The bound tracks collateral in real time with zero snapshots or stale state.
Collateral cannot be lent, re-pledged, or re-used. The vault is a one-way function: BTC in, proof out, credit drawn with nothing in between.
Collateral lives in a Taurus vault on Bitcoin; settlement and the unilateral exit are Bitcoin transactions. This app is one client for that path — it is not itself a settlement layer, and a live write is broadcast by the operator's node.
DrawBound is split across Bitcoin L1, an attestation layer, and an execution layer. Each has a narrow job; none can overstep the others.
Collateral vaults live here. Native BTC is locked in non-custodial script; settlement finality is Bitcoin's finality.
Generates and broadcasts cryptographic attestations of vault state. The bound is computed here; the execution layer consumes it.
Issues and tracks credit positions. Draws are accepted only up to the bound supplied by the proof layer, never beyond.
DrawBound is open-source and in active development. Read the spec, audit the mechanism, or launch the live terminal.