[ted-uneven]

No description provided.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
unevenlabs	🟢 Ready	View Preview	Nov 13, 2026, 3:19 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

Claude finished @ted-uneven's task in 44s —— View job

---

Code review

I found 2 problems in references/protocol/components/deposit-addresses.mdx. The PR adds strong non-custodial claims that the docs elsewhere contradict, and it leaves out the trust assumptions behind them.

1. "Funds can only be swept into the Depository" and "Funds stay recoverable" conflict with the feature guide

The new text says this in three places: line 9, line 45 ("can't move the funds to an address of its choosing") and line 48. But the feature guide describes funds that leave a deposit address without being swept or refunded:

• features/deposit-addresses.mdx:1498: "To recover an unsupported token, contact [Support]…" This page also says at line 53 that unsupported tokens "are never swept." So recovering them means moving the funds somewhere other than the Depository.
• features/deposit-addresses.mdx:887: deposits too small to cover refund gas, and EXACT_OUTPUT deposits sent on the wrong chain, can't be refunded. Users have to contact Support instead. That breaks "If the order can't be filled, it's refunded."

There's also a contradiction inside the new bullet at line 48. It says the signer "won't sign a transfer to an address the order doesn't specify," which implies it will sign transfers to addresses the order does specify. That reads as weaker than "only into the Depository."

This conflicts with AGENTS.md §1.2: "Ground 'decentralized,' 'trustless,' and 'non-custodial' in verified mechanics and scope … Do not replace security explanations with absolute guarantees."

Suggested fix: limit the claims to supported deposits, for example "Deposits of supported tokens can only be swept into the Depository." Also say how unsupported tokens and dust are recovered, or link to the feature guide's Supported Currencies and refund sections. Drop or reword the "address the order doesn't specify" sentence so it doesn't conflict with "only into the Depository."
Fix this →

relay-docs/references/protocol/components/deposit-addresses.mdx

Lines 44 to 50 in 5428419

	Deposit addresses are non-custodial. Relay never holds the private key for a deposit address and can't move the funds to an address of its choosing.
	- **No one holds the key.** Each address is derived for its order, and its private key only exists inside a signer running in a trusted execution environment (TEE). The key never leaves the TEE.
	- **Funds can only be swept into the Depository.** The signer signs a sweep only when it has a valid Oracle attestation for the order and the transaction deposits the attested amount into the approved Depository, under the order's depositor and order id. It won't sign a transfer to an address the order doesn't specify.
	- **Funds stay recoverable.** Once swept, the deposit is secured by the protocol like any other Depository deposit. If the order can't be filled, it's refunded. If the refund can't be paid out automatically, the order's `refundTo` or `recoveryAddress` can [withdraw the funds](/references/protocol/guides/withdrawals) directly.

2. "No one holds the key" doesn't match its own explanation, and the signer's trust assumptions are missing

The heading on line 47 says no one holds the key. The sentence after it says the key exists inside a TEE signer. Elsewhere the docs call that "the protocol's TEE signer" (references/protocol/guides/withdrawals.mdx:198).

The section never says:

• who runs the signer;
• that the guarantee depends on the TEE staying intact;
• who can change the signer's signing policy, and how upgrades happen.

AGENTS.md §1.2 requires these: "Preserve signer, permission, upgrade, halt, and recovery assumptions."

Suggested fix: rename the bullet to something like "Keys stay inside a TEE." Then add one sentence on who operates the signer, what the guarantee relies on (TEE integrity and the signer's policy), and how that policy is controlled or upgraded.

relay-docs/references/protocol/components/deposit-addresses.mdx

Lines 46 to 48 in 5428419

	- **No one holds the key.** Each address is derived for its order, and its private key only exists inside a signer running in a trusted execution environment (TEE). The key never leaves the TEE.
	- **Funds can only be swept into the Depository.** The signer signs a sweep only when it has a valid Oracle attestation for the order and the transaction deposits the attested amount into the approved Depository, under the order's depositor and order id. It won't sign a transfer to an address the order doesn't specify.

I also checked the links: #non-custodial-design and /references/protocol/guides/withdrawals both resolve, and the refundTo / recoveryAddress withdrawal description matches withdrawals.mdx:21.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation change appears safe to merge.

Summary

This documentation-only update explains why deposit addresses are non-custodial.

• Deposit-address docs explain how keys, sweeps, and recovery work.

No actionable issues found.

_{Reviews (1) · Last reviewed commit: "docs(deposit-addresses): explain non-cus..." · Reviewed by Greptile}