Proof, not promises.

Robyn AnyGas moves real value gaslessly across the hardest chains — and every claim below is a transaction you can verify on-chain, not a diagram.

On-chain proof

Live reserves · what backs the relay

The relayer fronts native gas from these balances. This is read live from the chains right now — nothing cached, nothing claimed.

Every payout is checked against its quote

A quote that overstates what arrives is worse than no quote, because it gets acted on — an agent budgets against it and a user is promised it. So we do not merely assert our quotes are honest, we check them against the chain: for each settled float-lane transfer we read the payout transaction and compare the amount that actually landed to the amount we quoted. They must match to the unit, because on that lane we perform the payout ourselves — any difference would be our own defect, not a vendor estimate drifting.

curl -s "https://anygas.xyz/svc/api/floatlane/transfers?verify=1"
# -> quoteAccuracy: { verified, exact, mismatched, verdict }
# every row carries the payout tx hash and a block-explorer link

The result is public at /receipts, with a link to every payout so you can reproduce the check yourself. This exists because the opposite once happened: a bridged leg quoted the amount before a fixed vendor fee, overstating delivery by 13% on small transfers, and nothing caught it for weeks — because nothing was comparing quotes to deliveries. Now something does, and it runs on every self-test.

Verify our receipts yourself

Every settlement is signed by the relayer. You do not have to take our word for any of it — the signature is checkable in three lines, and the transactions are checkable on the chains themselves.

curl -s https://anygas.xyz/svc/api/receipts/<yourAddress>

// scheme: EIP-191 personal_sign over the receipt's `digest` string
import { verifyMessage } from 'ethers';
verifyMessage(receipt.digest, receipt.signature) === response.verification.expectedSigner

Two things worth asserting, in this order:

• Rebuild the digest from the receipt fields and confirm it matches the one we returned — that stops a valid signature being replayed onto different values.
• Then verify the signature recovers to verification.expectedSigner. Alter one character of the digest and it will not.

The response carries a verification block stating the scheme, the expected signer and the exact digest format, so nothing has to be guessed. And because each receipt includes real srcTx and destTx hashes, you can confirm delivery on the destination chain without trusting this endpoint at all.

Privacy you can check, not just believe

Measured uniformity. Ten operation types — including a sealed message — sent through the live relay produce one request size, one response size and the same median latency; a classifier recovers the operation type at 8.5% against a 10% chance line. Re-runnable on the box; numbers and method at docs#uniformity-measured.

Every claim below is verifiable from outside. That is the point — a privacy promise you cannot test is a promise, not a property.

• The relay is real and separate. relay.nightferry.net runs in Iceland on a different provider from the gateway in Virginia. It sees your network address and cannot read your request; the gateway reads your request and never learns your address. Check its own status at relay.nightferry.net/health — it reports its independence honestly, including when that is degraded.
• We never hold your viewing key. Stealth derivation happens on your device. If any interface ever asks for a viewing or spending key, it is not us.
• No raw addresses are stored. Identifiers are hashed under a secret, rotating salt; after a rotation, records either side of it cannot be linked back together even by us.
• Erasure survives backups. Aged records are encrypted under keys destroyed on a schedule, so any surviving copy is unreadable ciphertext rather than a forgotten liability.
• Solvency without exposure. The Merkle-sum commitment above lets you verify we are backed without any balance being revealed, including yours to anyone else.

Full detail: privacy capabilities · machine-readable in /llms.txt under ## Privacy.

Why you can trust it