Don't trust us. Check.
The contract cannot be swapped.
The NEAR contract decides who may sign for the pooled positions, and it signs your eject. If nobody holds a full key, nobody can quietly change those rules.
See the data+
The agent runs in sealed hardware.
Your ledger lives inside an Intel TDX machine. The contract only accepts an agent whose hardware report matches the approved code. Anyone can fetch that report.
See the data+
The books match the chain.
After every batch the agent publishes pooled totals and writes a statement to NEAR. Here they are held up against the real Morpho positions on Base.
See the data+
We measure our own leaks.
We run the tricks a snoop would use on our own deposits and payouts, from public chain data only, and publish what they find.
See the data+
Already run on chain.
Every piece Offmap stands on was run for real first. Each run links to its transactions.
L1The first private loan, end to end
A user signed in and deposited 1.4 USDC from NEAR. It landed privately as 1,835 sats of cbBTC, batch 1 supplied it to the pooled cohort and borrowed 0.5 USDC, and the loan reached the user's own Base wallet from the shared Intents wallet after a random delay. Morpho shows one cohort, never the user.
S1A NEAR account runs a Morpho loan on Base
No Ethereum key exists for the Base address. NEAR's signer network (v1.signer) signed every step when the NEAR account asked: supply cbBTC, borrow USDC, repay, withdraw.
S2A private balance pays out with no trail back
3 USDC went into a Confidential Intents balance that only its owner can read. A signed intent then paid USDC on Base to a fresh wallet. The payout comes from the shared Intents wallet and names nobody.
S4Eject in one transaction
One user's share moves out of the pooled position into a Morpho position at their own wallet, through a flash loan, on a fork of Base mainnet against the real cbBTC/USDC market. The helper keeps no access afterwards.
S5Checking your place in the root costs 2 Tgas
A NEAR contract verified a real salted Merkle proof from a 700 user cohort padded to 1,024 leaves, with the exact encoding this app uses. The same proof against a wrong root fails.