> ## Documentation Index
> Fetch the complete documentation index at: https://musubinetwork.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Ethereum vs Musubi
> How Musubi's atomic, private, operator-less settlement differs from stablecoin transfers on public blockchains.
A stablecoin transfer on Ethereum moves value, and that's all it does — a single one-directional token movement, public to anyone, that settles regardless of what the counterparty does. Musubi moves value as an atomic four-leg swap: both currencies change hands in one Canton transaction, the counterparty's identity is never exposed to the market maker, and no single party can move the assets alone.
The reference case throughout this page: party A sends 1,000,000 USDC on Ethereum to party B.
## What's On-Chain
| Artifact | USDC on Ethereum | Musubi FXOrder |
| -------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Settlement shape** | One `Transfer(from, to, amount)` event — a single one-way leg | Atomic 4-leg DvP: both currencies move in the same Canton transaction, or none do |
| **Party identity** | Hex addresses, publicly visible to everyone | Canton party identities, observer-visible only to entitled parties — the market maker never sees the counterparties |
| **Visibility** | Global — every node sees every transfer | Per-sub-transaction privacy — each node stores only the contracts it is party to |
On Ethereum, the `Transfer` event is broadcast to the whole network and fires whether or not the receiving side ever expected it. On Musubi, the FXOrder carries party-ids and settlement data only, visible to entitled parties, and settles both legs atomically.
## Atomicity of Settlement
| Scenario | USDC on Ethereum | Musubi |
| ----------------------------------------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| One side of the swap fails | The sent leg already settled; recovering the return leg is a manual, off-chain problem | `ExecuteSettlement` exercises all legs in one transaction — if any leg fails, the whole transaction rolls back |
| Counterparty doesn't deliver the other currency | No coupling — the USDC is gone, the JPYSC0 may never arrive | Delivery-versus-payment: neither currency moves unless both do |
| Settlement-timing risk between the two legs | Sender is exposed for the entire gap between sending and receiving | Zero gap — both legs are a single atomic event |
A one-way `Transfer` is the *default* on Ethereum — atomicity across two currencies and two counterparties has to be engineered on top, with bridges, escrows, or trust. On Musubi, atomic delivery-versus-payment is the contract: `ExecuteSettlement` exercises `FXOrder.Settle` in the same DAML transaction.
## Privacy of the Trade
Ask: "who is on the other side of this 1M trade, and what rate did they get?"
Anyone can read it:
* The full transfer is on a public ledger — sender address, receiver address, amount, timestamp
* Address clustering and on-chain analytics link addresses to real-world entities
* Counterparties, amounts, and timing are visible to every observer, competitor, and indexer
There is no per-trade privacy. Pseudonymity is not confidentiality.
Only entitled parties see each part:
* The market maker prices an **anonymized RFQ** — it quotes on currency, amount, and timing without ever seeing the sender or receiver identity
* Each Canton node stores only the contracts it is a party to; there is no shared, globally-visible ledger
* The two counterparties and the operator see the full FXOrder; the market maker sees only the pricing sub-transaction
Confidentiality is enforced by Canton sub-transaction privacy, not by convention.
On Ethereum, blinding the counterparty means moving the trade off-chain entirely. On Musubi, the trade is on-ledger and the counterparty identity is still never revealed to the market maker.
## Non-Repudiation and Trust Model
| Property | USDC on Ethereum | Musubi |
| ----------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Value movement | One hot-wallet ECDSA signature | Operator + sender custodian + market maker + receiver custodian Canton signatures on the same transaction |
| Who can move the assets | Whoever holds the single private key | No single party — including the operator — can move assets unilaterally |
| Dual control | None — one key signs and the transfer is final | Maker-checker: the institution proves intent (`intent_signature`), the custodian co-signs the asset movement |
| Settlement proof | Tx hash | `transaction_hash` on the settled FXOrder |
On Ethereum, a single compromised key moves the funds and the transfer is irreversible. On Musubi, settlement requires the cryptographic co-signatures of four independent parties; the operator coordinates and co-submits the four-party settlement but never custodies assets or sets the FX rate. `intent_signature` is the institution's non-repudiable proof of intent — you can't disavow a settlement your custodian co-signed against an intent you signed.
## What You Give Up
Musubi isn't strictly better — it's a different trade.
| | USDC on Ethereum | Musubi |
| -------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| **Liquidity** | \$30B+ daily global volume, thousands of counterparties | Closed counterparty set (approved participants on a Canton network) |
| **Composability** | Tx can atomically interact with DeFi, bridges, wrapped instruments | Purpose-built for cross-border FX settlement; no general composability |
| **Access** | Permissionless — any address can transact | Permissioned — you must join the network as a known participant |
| **Settlement model** | One-way transfer, public, settles unconditionally | Atomic 4-leg DvP, private, co-signed by four parties |
Musubi buys atomic, private, dual-controlled settlement at the cost of open access and composability. For cross-border FX between a known set of participants, that is the trade worth making.
## The Structural Point
Public chains broadcast every transfer to every node and settle each leg independently — that is what makes them permissionless and composable, and also what exposes counterparties and leaves cross-currency settlement to bridges and trust.
Canton's sub-transaction privacy lets the FXOrder live on-ledger while showing each party only the parts it is entitled to see, and the four-party signature requirement means the assets move only when every required party co-signs. USDC-on-Ethereum is "one public ledger, one key, one one-way leg." Musubi is one private record, four signatures, two legs that move together or not at all.
This page compares the operational shape, not the technical merits of EVM vs. Canton as such. Ethereum remains the correct choice for permissionless access and DeFi composability. Musubi is the correct choice for atomic, private, multi-party cross-border FX settlement.