↔ Untrusted WASM
No ambient authority and no implicit account access.
Secure Smart Contract Runtime
Rivet enforces typed storage, linear handles, and explicit capability authority at the host boundary, even under adversarial WASM.
Most smart contract runtimes expose users to broad blast radius risk through escrow-heavy designs and ambient approvals.
Rivet keeps assets in account-controlled storage by default and requires explicit capabilities for cross-account actions.
Contract Rust ownership helps ergonomics, but the runtime trusts no WASM and enforces authorization, linearity, type correctness, and atomic commit itself.
See guarantees ↗No ambient authority and no implicit account access.
Capabilities, handles, and type tags are checked on every call.
Journaled commit/abort with deterministic gas accounting.
Storage keys are derived from canonical schema identity, and sensitive operations require typed capabilities that can be attenuated and revoked.
View crate map ↗Runtime invariants enforced at the host boundary
Always
Linearity, authorization, and type checks are runtime-owned.
Storage addressing model
Typed
Namespaces + canonical serialization, not string paths.
Execution substrate
WASM
Deterministic execution with gas metering + journaling.
Contract SDK model
no_std
Developer APIs are thin wrappers, runtime does enforcement.
Workspace architecture
9 crates
Core, stdlib, execution, runtime, harness, and more.
Current maturity
Prototype
Foundations work today; consensus remains pluggable.
Runtime Core
✓ Invariant checks active
Execution Engine
✓ Deterministic tx flow
Contract SDK
✓ WASM-ready SDK