Test networks only, for now Pearl Swap and our guardian run on Pearl testnet2 and Hyperliquid testnet. No real funds move through the bridge yet.

Keys · Public attestation

enderpearl.ai/keys

Public statement · Guardian, Pearl Swap

Test networks only, for now

Attestation · guardian t-mining · configuration epoch 1

Guardian key attestation

Every item is numbered. Section 6 shows how to check each one without taking our word for it.

Operator
Enderpearl, an independent operator. Not part of Pearl Research Labs or Pearl Swap.
Guardian
t-mining, one of three, at guardian.enderpearl.ai
Configuration
Epoch 1, agreed 23 September 2026
Threshold
2 of 3, enforced by each chain
Networks
Pearl testnet2 and Hyperliquid testnet
Stated
24 September 2026

Statement

Enderpearl operates guardian t-mining, one of the three guardians of Pearl Swap. The three keys in section 1 are ours. We generated all three on our own machine. Their private halves have never left it. Only the public halves are published: here, and in the configuration all three guardians run.

Our Pearl signing key, 1.1, is one of the three keys named in the Pearl escrow. Our Hyperliquid address, 1.2, is one of the three signers on the Hyperliquid treasury. Any two of the three guardians can move the escrow, so two colluding guardians could. We cannot move anything alone. Neither can anyone else.

Section 1. Our public keys

Each guardian holds three keys. These are the public halves of ours.

1.1

Pearl signing key

Our share of the escrow on Pearl. It is one of the three keys the escrow script names.

c3679e6cd3ed26d5775fc136bdef2aad0eda6018c04765658efecd3b9e5ab70a

x-only public key, hex · 32 bytes · 64 characters

1.2

Hyperliquid signer address

Our share of the treasury on Hyperliquid, as one of its three authorised signers. We use this account for signing bridge payouts and nothing else. It is active: it has received the deposit Hyperliquid requires before an account can submit payouts.

0xc87e693808208c814b79a0ec024f314aa8d4f3fd

Hyperliquid address, hex, lower case · 20 bytes · 0x and 40 characters

Look it up on the Hyperliquid testnet explorer

1.3

Identity key

Signs our guardian’s messages to the other guardians, and the deposit addresses it vouches for. It is separate from the two keys that sign for funds.

302a300506032b65700321004e6033092f793d3f8943fd3c3d52f164cf3bad27d759d0741bfe6e3ec25c27d4

Ed25519 public key, DER SubjectPublicKeyInfo, hex · 44 bytes · 88 characters

The first 12 bytes, 302a300506032b6570032100, are the DER header that marks an Ed25519 key. The last 32 bytes are the raw public key.

Section 2. The configuration

One configuration, shared by all three guardians. Its fingerprint identifies it.

2.1

Configuration fingerprint

Current · epoch 1
8a8615d24a920f6f3805c299318be5761beca9df218e4bb60a5f61d20bb67c06

64 hex characters · read it in groups of eight · all 64 must match

It is computed from the whole configuration: the three guardians and their keys, the threshold, the treasury and the token, the networks and the fees. Change any of it, a fee included, and the fingerprint changes. A guardian rejects anything built under a different configuration, matched by this fingerprint. Each guardian reports the one it runs as configHash at /status.

Earlier copies

  • f22e5e61… Superseded
  • f24767e2… Superseded

Do not use either.

2.2Epoch
1, agreed 23 September 2026.
2.3Threshold
2 of 3. Any two guardians can sign a payment. One cannot.
2.4Networks
Pearl testnet2 and Hyperliquid testnet. The guardians refuse mainnet. Test networks only, for now.
2.5Pearl confirmations
2 before a deposit counts, a testnet setting.

Section 3. What the keys control

An escrow on Pearl, a treasury on Hyperliquid, and the token. Each chain enforces its own 2 of 3. No guardian’s software can relax either rule.

3.1

Pearl escrow

testnet2

A P2TR output with an unspendable internal key. Its script needs 2 signatures from 3 named keys, and 1.1 is one of them. Every Pearl node enforces it.

tprl1pxzutjzl6dar32p8389gkhdylnq0659sv4r3xthpj8ytdst2jcuzq2mzte6

Taproot address, bech32m · prefix tprl · 64 characters

3.2

Hyperliquid treasury

testnet

A native 2-of-3 multi-signature account naming the same three guardians, with 1.2 as one of its signers. It holds the PRL token supply. Hyperliquid refuses any action without two signatures, including from the key that created the account.

0xefb6f8c559bca7b546b3dbc83f652a3fa1239c0d

Hyperliquid address, hex, lower case · 20 bytes

Look it up on the Hyperliquid testnet explorer

3.3

PRL token on Hyperliquid

testnet

PRL circulating on Hyperliquid is matched one for one by native PRL in escrow on Pearl. Each guardian checks this before it signs, and stops rather than sign a payment that would break it.

PRL:0x214b38dd02161ada14b926ab13bbd5e3

Token name and id, as the configuration writes it · id 16 bytes

Section 4. The guardian set

Epoch 1. Three guardians, run by different operators.

The three guardians of Pearl Swap in configuration epoch 1, in the configuration’s order, with who operates each and where it answers. Ours is t-mining, the third.
GuardianAnswers at
4.1mc-miningAnother operator https://guardian.deepnacre.com
4.2pearl-swapAnother operator https://g1.pearlswap.ai
4.3t-miningEnderpearl Ours https://guardian.enderpearl.ai

Listed in the configuration’s order. The escrow script takes the three Pearl keys in this order (6.4).

Each guardian runs on its operator’s own server, with its own Pearl node and its own three keys. Only the public halves of each guardian’s keys are published, in the configuration all three run. Ours are in section 1.

An id carries no privilege. Whose turn it is to lead a payment is a hash of the payment and the id, so the order is worked out afresh for every payment.

Section 5. What we will never ask you for

If anyone asks you for these in our name, it is not us.

  • 5.1Private keys

    Ours or yours. There is no procedure in which a private key is sent to anyone.

  • 5.2Signatures out of band

    We will not ask you to sign a message or a transaction by email, by chat, or because it is urgent. Our guardian acts only on what it has checked itself.

If anyone asks, do not act on it. Tell us at ops@enderpearl.ai. The rule runs both ways: we never send our private keys to anyone. If asked, the answer is no, and the other guardians are told.

Issued by

Enderpearl, operator of guardian t-mining

enderpearl.ai/keys · stated 24 September 2026

This page carries no signature. Check what it says by the steps in section 6.

Section 6. Check each item yourself

Four checks. Three need nothing from us: the other two guardians (6.1), Hyperliquid’s own answer (6.3) and your own Pearl node (6.4). The fourth, 6.2, asks our guardian directly, from your browser.

  1. 6.1

    Checks 2.1

    Compare the fingerprint over a channel you trust

    This page could be out of date, or not ours. Get the fingerprint a second way, from a source this site does not control. Read it in groups of eight. All 64 characters must match.

    Each guardian reports the configuration it runs, as configHash at /status, and two of the three are run by other operators. Ask all three. Their answers should agree with each other and with 2.1.

    Shell · any machine 
    for g in \
  https://guardian.deepnacre.com \
  https://g1.pearlswap.ai \
  https://guardian.enderpearl.ai
do
  echo "$g"
  curl -s "$g/status" | grep -o \
    '"configHash":"[0-9a-f]*"'
done
  2. 6.2

    Checks 2.1 Live

    Ask our guardian which configuration it runs

    Your browser asks guardian.enderpearl.ai for its /status when this page opens, and every 30 s while this tab is visible. Below, its configHash is set against 2.1, group by group. We relay nothing and fill in nothing.

    Our guardian, asked from your browser

    GET guardian.enderpearl.ai/status · not read yet

    Our guardian’s full record on Status

    Checking

    To check, run curl -s https://guardian.enderpearl.ai/status and compare configHash with 2.1, all 64 characters.

  3. 6.3

    Checks 3.2 1.2

    Ask Hyperliquid who can sign for the treasury

    Hyperliquid answers this itself. The reply lists the treasury’s authorised signers and its threshold. You should see three addresses, ours among them, and a threshold of 2.

    Shell · any machine 
    curl -s \
  https://api.hyperliquid-testnet.xyz/info \
  -H 'Content-Type: application/json' \
  -d '{"type": "userToMultiSigSigners",
       "user": "0xefb6f8c559bca7b546b3dbc83f652a3fa1239c0d"}'
    Look for
    threshold 2, and our address, 0xc87e693808208c814b79a0ec024f314aa8d4f3fd, among the three authorizedUsers
    Or
    Look the treasury up on the Hyperliquid testnet explorer
  4. 6.4

    Checks 3.1 1.1

    Rebuild the escrow address from its script

    The escrow address commits to one script and nothing else. Its internal key is the unspendable point from BIP 341, so nobody can spend it by the key path. Only the script can.

    Tapscript · the one leaf 
    <4.1 Pearl key>  OP_CHECKSIG
<4.2 Pearl key>  OP_CHECKSIGADD
<4.3 Pearl key>  OP_CHECKSIGADD
OP_2             OP_NUMEQUAL
    Keys
    The three guardians’ Pearl keys, in the configuration’s order, as section 4 lists them. Ours, 1.1, is the third. If 3.1 has been spent from, your own Pearl node shows the whole script, all three keys in order, in that spend’s witness. Find 1.1 in third place, then rebuild the address as below.
    Leaf version
    0xc0
    Internal key
    50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0
    Address
    Tweak the internal key with the leaf, then encode the output key as bech32m, witness version 1, prefix tprl. You should get 3.1, character for character.

Related pages

Status

Our guardian’s own record

Read live from guardian.enderpearl.ai in your browser: what it signed and led, its configuration and its Pearl height. When it cannot be read, the page says so.

Guardian

What our guardian checks before it signs

Our role in the 2 of 3, the eight checks, what we hold and what we never do, and who would have to do what for funds to move.