surge.foundation - Stewardship without custody

001 / Architecture

Three layers. No overlap.

Software is published. Protocols are stewarded. Bitcoin stays with you. The separation is the point.

Layer 01 · Software

Amby, Inc.

Delaware C-Corp · San Francisco

Publishes the open-source code. Holds no funds. Cannot move collateral. Operates the consumer app at surge.credit.

Layer 02 · Protocol

Surge Foundation

Non-profit · Cayman · In formation

Stewards the DCN, contracts, and upgrade path. Licenses tech from Amby. Acts only through participant governance.

Layer 03 · Bitcoin

You

Self-custody · Unilateral exit

Hold your keys. Co-sign your spends via BIP340 Schnorr. Exit unilaterally at any time. No quorum, no permission.

002 / Why a foundation

If we built it right, we shouldn't be the ones running it.

Threshold signing without governance separation is theater. A custody network where the publisher can swap the signers isn't a custody network. If Amby can change the contracts, the contracts aren't really immutable.

So we're separating ourselves from the thing we built. Amby keeps publishing software and operating surge.credit. The Foundation stewards the protocol - the DCN, the contracts, the upgrade path - and answers to participants, not to us.

The structural commitment that matches the cryptographic one.

Read the full case →

003 / Stewardship

What the foundation governs.

Two protocol surfaces. Both licensed from Amby. Both placed under participant governance. Neither under unilateral control.

Distributed Custody Network

DCN · Lin24 threshold Schnorr · TEE-attested

A set of independent signer organizations holding shares of the loanPubkey. No signer holds the full key - reconstruction would require compromising t signers simultaneously. Sessions produce BIP340 Schnorr signatures over Taproot sighashes. Misbehavior leaves Fischlin ZKP evidence that any observer can verify; faulty signers are excluded by policy, not by trust.

Become a signer

Independent organizations running compliant infrastructure can join the network.

Apply at signer.surge.foundation →

Smart contracts on Base

Immutable bytecode · Upgrades via governance

The deployed contracts are immutable. Any future upgrade, parameter change, or signer rotation must pass governance before the foundation executes it. Code is published; proposals are public from filing; outcomes are reproducible from chain state. The foundation cannot act unilaterally.

Inspect

Deployed addresses and verified source live in the docs. Pin the bytecode, replay the calls, audit the path.

004 / The exit

Don't trust. Verify. Then leave if you want.

The strongest property of any custody system is the one nobody talks about: the door out.

Unilateral exit

If the foundation disappears, your Bitcoin doesn't.

The unilateral exit path is open-sourced and reproducible. Any participant can run the exit client, on their own hardware, against the live chain - no permission, no coordinator, no foundation involvement. It is the structural backstop behind every other claim on this page.

Exit client on GitHub ↗Spec ↗

005 / Ecosystem

Open infrastructure. Many builders.

The DCN and contracts are an open credit market. Surge's own apps are the first to build on it - anyone else can build the next.

Live

Surge Borrow

Built by Amby, Inc. · app.surge.credit

Bitcoin-backed USDC credit lines. Variable and fixed markets, on-chain collateral, repay anytime.

Open ↗Live

Surge Earn

Built by Amby, Inc. · earn.surge.credit

USDC yield from real Bitcoin-backed borrowing. No rehypothecation. No wrapping. Live utilization rates.

Open ↗Live

Oracle Dashboard

Built by Amby, Inc. · oracle.surge.credit

Live view of the price feeds backing every market. Per-asset sources, latest updates, deviation history, and on-chain attestation paths - the inputs the contracts trust, made auditable.

Open ↗Coming soon

Build on Surge

SDK · open spec · permissionless

A complete builder track for partners running their own borrow flows, earn products, or distribution surfaces on top of the protocol. Onboarding instructions land here.

Read the docs ↗

006 / Governance

Decisions in the open.

The foundation is in formation. The participation surface will follow the same principle as the protocol: legible, verifiable, minimally trusted.

→ Propose

Anyone can submit

Parameter changes, signer additions, upgrade paths. All proposals are public from the moment they're filed.

→ Vote

Participants decide

Borrowers, LPs, and signer operators vote on what the protocol does next. The foundation executes the result.

→ Verify

Outcomes on-chain

Every change is signed, published, and reproducible. No silent updates. No hidden councils.