Keystone's first version put escrow logic, fee scheduling and role permissions in one 900-line contract. Two audits came back with the same complaint: the intent was buried, so reviewers spent their budget on control flow instead of the money paths.

We split the system into an escrow contract, a fee schedule that is data rather than code, and a thin permissions layer. Every function that moves value has a single owner role and a pause switch, and the whole suite is tested against a mainnet fork with the real balances of the accounts involved.

The indexed event log feeds a dashboard that answers the support question before it is asked. Settlement runs are now verifiable by counterparty without sharing internal records, and the paused-state drill is a scheduled exercise rather than a theory.

We wrote down what an attacker gains at every step, then designed the contract surface to make the expensive paths the boring ones. Anything that could not be explained in a paragraph was cut from scope.