0xMiden / 0xMiden/protocol

AggLayer: Maintain a `localBalanceTree` and implement invariance checks

未关闭
#2,330 5 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
agglayer
主要语言
Rust
星标
132
派生
167
平均合并
1 天 23 小时
30 天内合并 PR
110

描述

### Foreign asset invariance

As a connected chain to AggLayer, Miden must uphold the foreign-asset invariance: for each foreign token (i.e. originating outside of Miden), the chain must never be able to bridge-out more than was bridged-in, i.e. the local balance must never go negative.

With the current scope of Miden bridge specification, Miden does **not** have an explicit sanity check equivalent to the `localBalanceTree` protections used by AggLayer’s [sovereign chain L2 contracts](https://github.com/agglayer/agglayer-contracts/blob/60d06fc3224792ce55dc2690d66b6719a73398e7/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol). This creates a potential failure mode where Miden can progress on its own, but AggLayer will reject further certificates, effectively halting bridging until the imbalance is repaired (fork/revert/reorg etc.)

### Sovereign chains on AggLayer

In `agglayer-contracts`, [newer (v2) connected](https://github.com/agglayer/agglayer-contracts/blob/60d06fc3224792ce55dc2690d66b6719a73398e7/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol#L14) chains typically deploy the "sovereign" variants, and one of the key benefits is local onchain protection against invalid state transitions:
* maintain a `localBalanceTree`
* revert state transitions that would break invariants (e.g. when a foreign token balance would dip below 0)

For Miden, we initially won’t deploy the full extent of the sovereign contract logic.

### This is OK for now, but...

This is ok now, because when a [`Certificate`](https://docs.agglayer.dev/agglayer/core-concepts/pessimistic-proof/data-structures/#certificate) is sent to the AggLayer, AggLayer reconstructs its own view of the `localBalanceTree`. This is how the whole AggLayer system is protected against malicious chains.

The problem only happens if AggLayer realizes that some invariant was broken on Miden, but Miden doesn't catch this. But - assuming we design the contracts so that that foreign funds are only mintable via an AggLayer bridging, this should never happen.

Still it would be nice to eventually add these checks.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。