Exit to the balance owner.
Unshield reduces the caller's recorded token balance and transfers the same asset back to that caller.
Exit behavior
- The caller chooses a supported token and an amount no greater than the caller's recorded balance.
- The destination is the balance-owning wallet; unshield is not an arbitrary recipient transfer.
- A successful exit reduces both the wallet balance and aggregate liability before transferring tokens.
- Pause and registry approval state do not disable unshield.
Administrative limits
The owner cannot rescue tokens reserved for user liabilities. Rescue is limited to excess inventory after liabilities are accounted for. This constraint does not remove smart-contract, token, key-management, or chain risk.
Public withdrawal
Only pre-trade RFQ intent is private/offchain; shield deposits, contract balances, final fills, and unshield withdrawals are public onchain.
The withdrawal wallet, token, amount, contract, and transaction timing are observable. Unshield provides an exit, not anonymity.
BetaExits are designed to remain available during pause and after approval expiry or revocation.