Skip to main content
Nacre is a two-chain protocol with a handful of moving parts. This page gives a top-down view; the rest of the section drills into each piece: the Pearl side, the Solana side, and the signature aggregator. For where the architecture is headed next, see the Roadmap.

​
Trust model in one sentence

Every state transition that moves PRL or mints/burns wPRL requires a threshold signature from a quorum of independent validators, and every user deposit has a unilateral 7-day emergency exit.

​
System components

Nacre architecture: Pearl L1 reserves, Solana programs, signature aggregator, and the N-validator quorum

​
Validators

The quorum is not a consensus group. Validators do not gossip, vote, or exchange messages. Each independently observes both chains, builds proposals deterministically from finalized state, and signs the proposal hash with its P-256 key. Determinism is enforced by cross-implementation test vectors and fuzz harnesses, so two honest validators produce byte-identical proposals and reach the same proposal_id. Equivocation is observable on chain. Operator details, security commitments, and the genesis validator set live on the Validators page.

​
Authority hierarchy

Validators have no admin powers. Admin has no validator powers. The two authorities are cryptographically disjoint.