Gatekeeper

​

Responsibilities

1. Monitor DepositPending events.
2. Screen depositors with chain-analysis tools.
3. Approve with approveDeposit(), binding a trace key into the note.
4. Reject with rejectDeposit(), refunding the depositor.
5. Pull ERC-20 deposits with pullDeposit() against a signed PullIntent.

​

Gatekeeper address

​

Approve

function approveDeposit(
    uint256 index,
    address recipient,
    address token,
    uint256 amount,
    address depositor,
    uint256 gasEscrow,
    uint256 revocationPublicKeyX,
    uint256 revocationPublicKeyY,
    uint256 revocationPublicKeyHash   // used as the note's value trapdoor
) external;

1. charges the deposit fee in force at that moment
2. inserts a note for amount − fee to the recipient’s inbox key
3. emits NoteAdded, DepositStatusChanged(APPROVED), Deposit
4. settles the gas escrow

​

Reject

function rejectDeposit(
    uint256 index,
    address recipient,
    address token,
    uint256 amount,
    address depositor,
    uint256 gasEscrow,
    uint256 checkCost
) external;

​

Permit deposits

PullIntent(address depositor, address token, uint256 amount, bytes32 requestId, uint256 deadline)
domain: { name: "Veilify", version: "1", chainId: block.chainid, verifyingContract: pool }

• Each requestId can be used once (PullRequestUsed).
• Expired intents are refused (PullIntentExpired).
• ECDSA is tried first, then ERC-1271, so EIP-7702 accounts and smart wallets both work.
• The note always goes to the depositor’s own inbox key. There is no recipient parameter.
• The gas withheld is capped at maxPullGasFee[token] and at 5% of what arrived.

​

Gas escrow settlement

price   = min(tx.gasprice, block.basefee + 3 gwei)
toGuard = min(escrow, (gasMeasured + overhead) × price)
toUser  = escrow − toGuard

• overhead is settleGasOverhead, or 45,000 gas while that is 0. On Robinhood Chain it is raised to cover the L1 data fee.
• When one transaction settles several deposits, every settlement after the first gets 25,000 gas less, so batching can’t turn escrow into profit.
• The depositor’s share is sent with a 30,000-gas stipend. A wallet that refuses it forfeits it to the gatekeeper, so it can never block its own credit.