I noticed the awkward part of Dusk is not sending a private transfer. It is what happens when that transfer has to become an exchange credit without the operator guessing who owns it.
For deposits, Dusk does not pretend Phoenix and Moonlight are interchangeable. Phoenix uses shielded notes and nullifiers, while exchange integrations are steered to Moonlight because the custody and scanning model is different. So the operator still has to choose how attribution works: one Moonlight account per customer, or a shared account where the memo becomes routing data.
Then the ugly failure case appears. A valid transfer can arrive with missing, malformed, unknown, or reused metadata. The chain can settle correctly and the credit still has to be quarantined instead of posted to the wrong user.
The detail I keep coming back to is the checkpoint. Dusk expects credits and the scanned block checkpoint to be written atomically, with the transaction ID used for idempotency. Advance the checkpoint before the credit is durable and a crash can leave that deposit outside the operator’s ingestion path.
For Dusk, the real custody test is whether a finalized Moonlight deposit can ever vanish between checkpoint and credit.
#dusk $DUSK @Dusk
#USJulyCPI&PPIDueThisWeek
For deposits, Dusk does not pretend Phoenix and Moonlight are interchangeable. Phoenix uses shielded notes and nullifiers, while exchange integrations are steered to Moonlight because the custody and scanning model is different. So the operator still has to choose how attribution works: one Moonlight account per customer, or a shared account where the memo becomes routing data.
Then the ugly failure case appears. A valid transfer can arrive with missing, malformed, unknown, or reused metadata. The chain can settle correctly and the credit still has to be quarantined instead of posted to the wrong user.
The detail I keep coming back to is the checkpoint. Dusk expects credits and the scanned block checkpoint to be written atomically, with the transaction ID used for idempotency. Advance the checkpoint before the credit is durable and a crash can leave that deposit outside the operator’s ingestion path.
For Dusk, the real custody test is whether a finalized Moonlight deposit can ever vanish between checkpoint and credit.
#dusk $DUSK @Dusk
#USJulyCPI&PPIDueThisWeek