Chainflip processes native cross-chain swaps without bridges or wrapped tokens. Behind this functionality sits a carefully designed architecture that splits work between two distinct layers: the State Chain (built on Substrate) and off-chain validator processes. Understanding this split explains why Chainflip can coordinate complex multi-chain operations while maintaining decentralization.
What Is the State Chain?
The State Chain is Chainflip's own blockchain, built using Substrate (the same framework behind Polkadot). It serves as the coordination and consensus layer for the entire protocol. Every validator runs a State Chain node, and the chain maintains the authoritative record of swap requests, vault states, validator sets, and protocol parameters.
Think of the State Chain as the protocol's brain. It doesn't execute swaps directly on external chains like Bitcoin or Ethereum. Instead, it tells validators what needs to happen, tracks what has happened, and reaches consensus on the current state of everything.
What Runs on the State Chain
Several core operations execute directly on the State Chain:
Validator Set Management
The State Chain tracks which validators are active, their staked FLIP amounts, and their participation in the current authority set. When validator auctions determine the next authority set, this happens entirely on-chain. The auction mechanism, bid processing, and authority rotation are all Substrate pallets (modular runtime components) that execute deterministically across all nodes.
Vault Rotation Coordination
Chainflip's vaults hold assets on external chains. When the validator set changes, vault keys must rotate to reflect the new authority set. The State Chain coordinates this process: it determines when rotation should occur, which validators participate, and confirms when new vaults are ready. The actual key generation happens off-chain (more on this below), but the State Chain orchestrates the entire sequence.
Witnessing and Deposit Tracking
When users deposit assets to Chainflip, validators watch external chains and submit "witness" transactions to the State Chain. Once enough validators witness the same deposit, the State Chain accepts it as confirmed. This threshold witnessing (requiring agreement from a supermajority of validators) prevents any single validator from fabricating deposits.
Swap Intent Processing
Swap requests, including source asset, destination asset, and recipient address, are recorded on the State Chain. The JIT AMM logic that determines swap execution prices runs here as well. When market makers provide quotes, the State Chain processes these and determines which liquidity fills each swap.
What Happens Off-Chain
Some operations cannot run on a blockchain, either because they require external data or because they involve cryptographic ceremonies that must remain private until complete.
Threshold Signature Generation
Chainflip's vaults are controlled by threshold signatures. No single validator holds a complete private key. Instead, validators each hold key shares, and producing a valid signature requires participation from a threshold number of validators. This signing process happens off-chain through peer-to-peer communication between validators. The State Chain only sees the final signature once it's complete.
Why off-chain? The intermediate steps of threshold signing must remain private. If partial signatures were published on-chain before completion, attackers could potentially reconstruct keys. The off-chain signing ceremony protects these intermediate values.
External Chain Monitoring
Each validator runs monitoring software (called the "CFE" or Chainflip Engine) that watches Bitcoin, Ethereum, Solana, and other supported chains for relevant transactions. This monitoring is inherently off-chain because it involves reading from external blockchains. Validators then bring this information on-chain by submitting witness transactions.
Transaction Broadcasting
When the protocol needs to send assets on an external chain (completing the output leg of a swap), validators broadcast the signed transaction to that chain's network. The State Chain coordinates who broadcasts and tracks confirmation, but the actual interaction with external mempools happens off-chain.
A Simple Architecture Overview
Visualize Chainflip's architecture as three layers:
External chains (Bitcoin, Ethereum, Solana, etc.): Where user assets actually live and where deposits/withdrawals occur
Off-chain validator processes (CFE): Monitors external chains, participates in threshold signing, broadcasts transactions
State Chain (Substrate): Records consensus state, coordinates validators, processes swap logic, manages vaults
Data flows upward (external chain events witnessed and recorded on State Chain) and instructions flow downward (State Chain tells validators what signatures to produce and what transactions to broadcast).
Why Substrate?
Chainflip chose Substrate for several practical reasons. Substrate provides a modular runtime architecture where protocol logic lives in "pallets" that can be upgraded without hard forks. This matters for a cross-chain protocol that needs to add new chains and update parameters over time.
Substrate also offers built-in support for custom consensus mechanisms. Chainflip uses Aura (authority round) consensus with a validator set determined by FLIP staking auctions rather than proof-of-work or general proof-of-stake. Substrate made implementing this custom authority selection straightforward.
Finally, Substrate's Rust-based development environment aligned with the need for performance-critical cryptographic operations. Validators must handle significant computational load when monitoring multiple chains and participating in signing ceremonies.
The Split Matters for Security
This architecture creates a clear security boundary. The State Chain is the source of truth for protocol state, but it never has access to complete private keys. Even if an attacker compromised State Chain consensus, they couldn't steal vault funds without also compromising the off-chain threshold signing process.
Conversely, the off-chain components can't act without State Chain authorization. Validators can't initiate unauthorized withdrawals because the State Chain must first authorize the transaction and reach consensus on what should be signed.
This separation also enables transparency. Anyone can run a State Chain node and audit the protocol's state. The on-chain record shows exactly what was witnessed, what swaps were processed, and what transactions were authorized.
How It Comes Together in a Swap
When you swap BTC for ETH on Chainflip:
You send BTC to a Chainflip vault address (external chain)
Validators' CFE software detects your deposit (off-chain monitoring)
Validators submit witness transactions to the State Chain (on-chain)
State Chain reaches consensus on the deposit and processes swap logic (on-chain)
State Chain authorizes an ETH payout to your address (on-chain)
Validators participate in threshold signing for the ETH transaction (off-chain)
A validator broadcasts the signed transaction to Ethereum (off-chain)
State Chain records the completed swap (on-chain)
Each step happens in the appropriate layer, with the State Chain coordinating the entire flow while never directly touching external chain assets or holding complete signing keys.
This architecture enables Chainflip to process native cross-chain swaps with strong security guarantees. The State Chain provides transparent, auditable coordination while off-chain processes handle the cryptographic operations that must remain private.
To see this architecture in action, try a swap at swap.chainflip.io or explore completed swaps on Chainflip Scan.
Resources
Swap Now - Start swapping native assets
Lend BTC - Borrow against native Bitcoin
Blog - Product updates and announcements
Chainflip Scan - Track swaps and network activity
Website - Explore Chainflip
Other Chainflip Products:
Boost - Earn fees by providing single-sided liquidity with no IL risk
Stablecoin Strategies - Deposit stablecoins and earn optimized yields
Provide Liquidity - Supply assets to Chainflip's liquidity pools
Stake FLIP - Delegate FLIP and earn staking rewards
Find us:
What is the State Chain in Chainflip?
The State Chain is Chainflip's Substrate-based blockchain that serves as the coordination and consensus layer for the protocol. It tracks validator sets, swap requests, vault states, and protocol parameters while coordinating all cross-chain operations.
Why does Chainflip use Substrate?
Substrate provides modular runtime architecture for easy upgrades, custom consensus mechanism support, and a Rust-based development environment suited for performance-critical cryptographic operations. This makes it well-suited for a cross-chain protocol that needs to add new chains and update parameters over time.
What's the difference between on-chain and off-chain operations in Chainflip?
On-chain operations (State Chain) include validator management, vault rotation coordination, witnessing deposits, and swap processing. Off-chain operations include threshold signature generation, external chain monitoring, and transaction broadcasting to other networks.
How does the on-chain/off-chain split improve security?
The State Chain never has access to complete private keys, so compromising it alone can't steal funds. Meanwhile, off-chain components can't act without State Chain authorization. This separation creates a security boundary where both layers must work together, making attacks significantly harder.
Can anyone run a State Chain node?
Yes. Anyone can run a State Chain node to audit protocol state and verify the record of witnessed events, processed swaps, and authorized transactions. This transparency is a key feature of Chainflip's architecture.
