Cross-Chain Messaging and Bridges
Introduction
Cross-chain systems create claims in one execution domain based on events or state from another. The branch studies message verification and lifecycle before token movement abstractions.
Why It Matters
Bridges combine high-value accounting with mismatched finality, validator/relayer assumptions, asynchronous retries, wrapped assets, upgrade keys, and operational recovery. Collapsing those states creates replay, double-mint, stuck-message, and insolvency risk.
Mental Model
A message binds source/destination chain and contract, payload, sender, nonce/order, source finality evidence, verifier, execution status, retry policy, and accounting effect. Pending, accepted, executed, failed, and recovered are distinct states.
Questions This Branch Answers
- Who or what proves a source event to the destination?
- How do replay, ordering, reorg, retry, and partial failure interact?
- Which controls limit damage when verification or liquidity fails?
Scope
Bridge taxonomy, lock/mint/burn/liquidity models, cross-domain messages/nonces, replay/idempotency/ordering, finality mismatch/reorg recovery, rate limits/pauses/accounting, canonical bridges/CCIP/IBC, and incident lessons.
Out of Scope
Live asset bridging, bridge yield, universal interoperability claims, production validator sets, and ranking protocols without versioned architecture and evidence.
Dependencies
finality/reorgs, L2 settlement, token behavior, and distributed messaging.
Candidate Note Roadmap
bridge-taxonomy-and-trust-models— Classify verification, custody, liquidity, admin, and recovery assumptions.lock-mint-burn-and-liquidity-networks— Reconcile canonical and synthetic asset movement models.cross-domain-messages-and-nonces— Bind domains, identities, payloads, and message uniqueness.replay-idempotency-and-ordering— Make retries safe under duplicate and reordered delivery.finality-mismatch-reorgs-and-recovery— Simulate source rollback after relay or destination execution.rate-limits-pauses-and-accounting— Bound exposure and retain reconciliation during incidents.canonical-bridges-ccip-and-ibc— Compare concrete verification and channel architectures.bridge-incidents-and-wrapped-asset-risk— Reconstruct primary failure mechanics and residual claims.
Future Project
A two-domain Cross-Chain State Mirror with controllable finality, relayer retries, at-most-once execution, explicit message states, per-chain accounting, rate limits, and reorg/compromise incident drills.
Initial Invariants
Each valid message executes at most once; retries are idempotent; source/destination/domain fields cannot be substituted; minted/locked/burned/released accounting reconciles; pending, failed, and finalized states never collapse.
Initial Threat Model
Verifier/validator/admin compromise, source reorg, forged or replayed messages, inconsistent ordering, liquidity exhaustion, wrapped-asset depeg, pause abuse, rate-limit bypass, upgrade takeover, relayer censorship, and recovery double-spend.
Primary Sources
Canonical L2 bridge specifications, Chainlink CCIP and Cosmos IBC specifications, protocol postmortems, and sources catalogued in SOURCES.md.
Connects to: rollups, privileged controls, and reconciliation/response.