Exits No One Can Block

A normal withdrawal needs some node to put it in a settlement. If every node refused yours, you would be stuck. Cheshire has two more ways out so that nobody can keep you in.

way out	you need	use it when
withdrawal	a node to include it	always: the normal case
exit request	a Bitcoin coin to pay the request’s fee, and a pool that keeps settling	nodes are ignoring you
solo exit	a laptop, a few minutes, and no one else	nobody is settling at all

The exit inbox (forced exits)

The exit inbox borrows from the rollups that have shipped forced inclusion, Arbitrum’s delayed inbox and Optimism’s deposit portal.

1. You prove an exit request. It says: a note under some recent root is mine; here is its nullifier key, the amount, a processing fee, and where to pay it. It does not depend on the pool’s current state, so it never goes stale.
2. You post it yourself, on Bitcoin. You send a transaction that spends the inbox coin and makes a new one with your request added to its hash chain. The inbox script checks your request’s proof itself. Anyone can do this; there is no one to ask. The transaction is about 51 kvB, because it carries its own verifier, and you pay its fee from an ordinary Bitcoin coin.
3. Every sixth settlement is a drain. It must spend the inbox and process every queued request, in order. No other settlement may touch the inbox. The pool’s script enforces both with OP_MOD on the epoch.
4. The drain pays or voids each request, with no choice. For each request: if its root is within the last 16 and its note is unspent, the nullifier goes into the tree and the amount goes out through the vault. Otherwise the request is void: consumed, unpaid, and nobody chose that.

A settlement that should drain and does not is invalid. So a pool that keeps settling must keep paying exits. At one settlement per block, a request is processed within about an hour; at today’s pace it waits for the next drain, whenever that comes.

Limits, plainly:

• One request per inbox coin per block (each request spends the coin). An inbox holds up to 32 requests between drains.
• A void request still costs its Bitcoin fee. A wallet avoids voids by using a fresh root.
• Miners can still censor, as with any Bitcoin transaction.

The solo exit

The pool’s script tree also has an exit leaf. With it you can leave alone, with one note:

• You prove one direct statement (this note, my key, its nullifier, the amount and fee, the destination), with no recursion, in a few minutes on a laptop.
• You send one transaction that spends the pool coin itself. It runs the exit verifier inline, inserts your nullifier at the next free position, takes amount + fee from the pool and pays you.
• The pool coin continues from your exit, and the next settlement accepts an exit as its predecessor.

A solo exit competes with settlements for the pool coin. If a settlement confirms first, your exit is invalid and must be rebuilt against the new coin. That is why the exit inbox exists. The solo exit is the floor beneath it: it works when the whole network is gone.

It costs about 53 kvB (53,343 vB measured after the 2026-11-07 re-pin), and its fee comes out of the note: at 1 sat/vB, at least about 53,000 sat.

Status

A forced exit request was drained through the inbox with real proofs on 2026-10-29 and again on 2026-11-04 (the drain was 45,531 vB; the vault paid 1,168,000 sat). Solo exits have run on a GSR regtest node, built and tested at a test-grade proof-of-work setting. Both are unaudited.