We don’t ask for your trust.The code proves it.
Everything below can be checked without us: public contracts, addresses read live from the chain, and real operations anyone can open in an explorer. You don’t have to take anyone’s word for it: you can check.
Only what you signed can ever run.
You review the order
ASTRYUM prepares the unsigned transaction and shows you all of it: what it does, where it goes and what it costs. Nothing travels yet.
You sign a fingerprint
When you sign in your wallet, the signature carries the order’s fingerprint — its unique mathematical digest. Changing a single byte changes the whole fingerprint.
Flare recomputes it
Before executing, the Flare contract recomputes the fingerprint of the order it receives and compares it with the one you signed.
No match, no trade
A single different byte — ours included — and the network rejects the operation. Only exactly what you signed can be delivered, or nothing at all.
Truly non-custodial: your keys and your capital never pass through us. It is not a promise we make — it is how the network treats every order.
Change one byte and watch what happens.
Sign it in your browser, change one byte and see why the contract would not accept it: it is what the network does with every order.
Reading the chain…
One bit is enough: each byte you touch flips only its last bit. Both fingerprints are keccak256 — the network’s standard fingerprint algorithm — computed on your device, not on our servers.
Of the four pieces on the path, one is ours.
This is the path your XRP travels when it goes to work on Flare. Three pieces belong to the protocol; ours can only deliver — never decide. The addresses are read from the chain when this page loads.
Core Vault
FAssets’XRPLThe FAssets protocol’s XRPL account that receives your XRP on its way into Flare. Its address is read from the protocol on every operation — we never type it by hand.
Could not be read right now — reload in a moment.
AssetManagerFXRP
Flare’sFlareThe FAssets protocol contract that turns your XRP into FXRP — its representation on Flare — directly in your account. Not in ours.
Could not be read right now — reload in a moment.
MasterAccountController
Flare’sFlareThe Flare contract that compares the fingerprint you signed with the order it receives. It is the lock: if they don’t match, the operation does not pass.
Could not be read right now — reload in a moment.
Executor
oursFlareThe only piece of the path that is ours: it delivers your already-signed order and pays the network’s fees for you — the gas and the proof that your signature exists on XRPL. It cannot edit or redirect it: the lock in the previous piece forbids it.
Could not be read right now — reload in a moment.
Transparency · verifiable
Real operations, public receipts.
The counter stays live and covers every operation settled through ASTRYUM. Below we keep a closed sample of our own operations, with its public receipt: the links go to the XRPL and Flare explorers, where anyone can verify it without us.
Reading the chain…
Public on-chain data (hashes and amounts) from our own operations. Our users’ operations are never published here: a transaction hash leads to their account on the explorer, so we don’t show the hash either. The counter refreshes every 30 s; the sample is closed.
Do the math the network does.
This is a real operation that already completed, made from an account of ours — we never publish our users’. Your browser can recompute its fingerprint and compare it with the one that travelled in the signature: the same check the network ran before executing it.
What we cannot promise you.
No external audit yet
This page describes how the system is built, but no independent firm has reviewed it yet. Meanwhile, the app is not open to the public: we use it ourselves, with small amounts.
We depend on third-party protocols
FAssets, the Flare protocols and the XRPL network itself are public infrastructure we do not control. If a piece fails, your operation may be left waiting — but the only thing that can ever execute is still what you signed.
Our piece can stall
If the executor runs out of fuel or goes down, your order is not delivered on time. What cannot happen is for it to go anywhere else: it waits, and only your exact order can ever leave that queue.
We do sign two things — and neither is your money
Our savings keeper sends an escrow’s release from ITS own account, paying its own fee: that operation is permissionless by XRPL design — anyone can send it once the date arrives, and the ledger decides where the money goes (to the destination you set, or back to you). And our Flare relayer carries orders YOU already signed, with the contract comparing the fingerprint and reverting if it does not match. We trigger outcomes the network had already decided; we move nobody’s capital. If we switched both pieces off tomorrow, any third party could press those same buttons.
A page that only told the good parts would be advertising. This one exists so you can check both.
Check it with your own eyes.
The app is not open to the public: we will tell you by email when it opens, and then you will see this same thing with your real accounts.
Get the updates →