0xMiden / 0xMiden/protocol

AggLayer: Maintain a `localBalanceTree` and implement invariance checks

オープン
#2,330 コメント 5 件 リアクション 1 件 担当者 0 名 GitHub で見る
agglayer
主要言語
Rust
スター
132
フォーク
167
平均マージ
1日 23時間
マージ済み PR(30日)
110

説明

### Foreign asset invariance

As a connected chain to AggLayer, Miden must uphold the foreign-asset invariance: for each foreign token (i.e. originating outside of Miden), the chain must never be able to bridge-out more than was bridged-in, i.e. the local balance must never go negative.

With the current scope of Miden bridge specification, Miden does **not** have an explicit sanity check equivalent to the `localBalanceTree` protections used by AggLayer’s [sovereign chain L2 contracts](https://github.com/agglayer/agglayer-contracts/blob/60d06fc3224792ce55dc2690d66b6719a73398e7/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol). This creates a potential failure mode where Miden can progress on its own, but AggLayer will reject further certificates, effectively halting bridging until the imbalance is repaired (fork/revert/reorg etc.)

### Sovereign chains on AggLayer

In `agglayer-contracts`, [newer (v2) connected](https://github.com/agglayer/agglayer-contracts/blob/60d06fc3224792ce55dc2690d66b6719a73398e7/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol#L14) chains typically deploy the "sovereign" variants, and one of the key benefits is local onchain protection against invalid state transitions:
* maintain a `localBalanceTree`
* revert state transitions that would break invariants (e.g. when a foreign token balance would dip below 0)

For Miden, we initially won’t deploy the full extent of the sovereign contract logic.

### This is OK for now, but...

This is ok now, because when a [`Certificate`](https://docs.agglayer.dev/agglayer/core-concepts/pessimistic-proof/data-structures/#certificate) is sent to the AggLayer, AggLayer reconstructs its own view of the `localBalanceTree`. This is how the whole AggLayer system is protected against malicious chains.

The problem only happens if AggLayer realizes that some invariant was broken on Miden, but Miden doesn't catch this. But - assuming we design the contracts so that that foreign funds are only mintable via an AggLayer bridging, this should never happen.

Still it would be nice to eventually add these checks.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。