Functionary

A functionary is one of the specialized physical devices that operate and secure a federated Bitcoin sidechain such as Liquid. Each functionary pairs a server with a tamper-resistant hardware security module (HSM) that guards the cryptographic keys, and the set of functionaries collectively replaces proof-of-work mining with a known, permissioned signing membership. There are currently 15 functionaries on the Liquid Network, hosted by independent federation members distributed across multiple jurisdictions and continents, so that no single operator, facility, or government controls a quorum.

Two roles: block signer and watchman

Functionaries wear two hats. As block signers, they propose and sign sidechain blocks in round-robin fashion, producing a deterministic one-minute block cadence; a block is accepted once a supermajority of functionaries have signed it. This is federated consensus: fast and final, but resting on the honesty of a known set rather than on open competition for work. As watchmen, the same devices collectively custody the pegged-in bitcoin on the main chain and authorize peg-outs back to it. The HSM enforces its own rules independently of the server it lives in — it tracks block height and the previous block hash and will never sign a block that moves the chain backwards, cutting off reorg-style attacks even if the host server is fully compromised.

The 11-of-15 threshold

The federation secures the locked bitcoin with an 11-of-15 multisignature arrangement, one key per functionary HSM. Spending from the peg requires at least 11 signers, so the network tolerates several simultaneous failures, outages, or compromises before custody is at risk — while an attacker would need to subvert eleven hardened devices in different countries at once. An emergency timelock provides a recovery path: if the federation ever becomes permanently non-functional, a small set of offline recovery keys can reclaim the funds after a long delay, ensuring the pegged coins are not lost forever with a dead federation.

The trust model, honestly stated

A federated sidechain is a deliberate compromise, and it should be described as one. Users of the sidechain trust the functionary federation not to collude, in exchange for faster settlement, confidential transactions, and asset issuance that the base layer does not offer. This is materially better than trusting a single custodian — collusion requires a supermajority of independent parties — but it is categorically weaker than the trustless guarantees of Bitcoin itself, where security rests on open proof-of-work and validation by anyone running a node. The sovereign framing is simple: coins in a federated peg are custodied by machines and institutions you can name. For long-term savings, self-custody on the main chain in cold storage remains the standard; federated sidechains are a tool for the coins you are actively moving, trading, or issuing against.

How it fits together

The architecture also illustrates a general lesson in mechanism design: security by geography and jurisdiction. Because functionary hardware is deliberately spread across independent operators in different legal regimes, compromising the federation requires either a simultaneous multi-country technical attack on hardened HSMs or legal coercion of a supermajority of members across borders — both categorically harder than seizing one company's servers. It is the same instinct that drives Bitcoin's own geographic distribution of hashrate and nodes, applied to a permissioned setting: when you cannot eliminate trust, scatter it widely enough that no single power can collect it.

Functionaries are what make a peg-in and peg-out possible: the watchmen watch the main chain for deposits and sign the withdrawals. Their multisig is the beating heart of the federated peg, and their block-signing rotation is what gives the sidechain its clock. Understand the functionary and you understand exactly where a federated sidechain's security begins — and where it ends.