PaperlayerView exact revision on arXiv

Source-linked AI summary

An EVM-Cosmos Bridge for Atomic, Semantic-Preserving Transfer of Environmental Tokens

Sebastian Pandolfi, Guzmán Llambías, Laura González

arXiv:2610.37663v1cs.SE

TL;DR

Heterogeneous-chain transfers of domain-specific tokens must preserve both settlement atomicity and token meaning. The paper proposes an HTLC-based bridge with an automatic source-burn callback, a bounty-backed monitor fallback, and deterministic class identities. Its mainnet prototype completed transfers automatically in both directions, while the callback-failure safety guarantee remains conditional on a live observer.

  • Problem

    Cross-chain transfers must avoid leaving tokens on both chains or neither, while preserving distinctions among domain-specific token classes.

    Source: §I · p. 1

  • Method

    The bridge adapts HTLCs to single-owner transfer with an automatic callback that burns source escrow, a minimum bounty for fallback burns, and deterministic indicator identities checked against mirrored registries.

    Source: §I · pp. 1–2, B. Weak Supply Conservation: A… · p. 8

  • Results

    97 s median end-to-end latency across 50 Polygon→Neutron transfers over 7 days, all completed by the automatic callback; reverse-direction validation completed in 93 s.

    Source: A. Atomic Transfer Results · p. 6

  • Takeaways & Limitations

    The prototype demonstrates fully automatic bidirectional transfers, while the callback-failure regime’s supply-conservation guarantee depends on a rational, live observer.

    Source: E. Security Argument · p. 7, §VIII · p. 8

    The latency campaign covers 50 EVM→Cosmos transfers, while reverse-direction characterization used n = 2; implementation-level verification remains open.

    Source: E. Limitations · p. 8

Abstract

from arXiv · show

Transferring semantically typed tokens between heterogeneous blockchains (e.g. EVM and Cosmos ecosystems) raises two problems: semantic mixing, the loss of a token's domainspecific meaning in transit (e.g., CO2 removals issued under different methodologies), and atomicity despite divergent consensus and timing assumptions. We propose a bridge that addresses both. A deterministic indicator identity derived from cryptographic commitments, mirrored in class registries on both chains and checked at mint time, preventing semantic mixing by construction. For atomicity, we extend hash time-locked contracts (HTLCs) from two-party exchange to single-owner transfer with an automatic callback that burns the source escrow after a destination claim, and a protocol-minimum bounty that makes the fallback burn incentive-compatible even against adversarial senders. We machine-check the protocol's invariants with TLC (supply conservation fails without the rational-monitor assumption and holds with it) and validate a bidirectional prototype on Polygon and Neutron mainnets over Axelar GMP: fully automatic transfers with a median end-to-end latency of 97 s over 50 Polygon to Neutron transfers across 7 days (all completed by the on-chain automatic callback) and 93 s in the reverse direction, and semantic-validation overhead below 0.4% of messaging cost. We also document the integration failure modes of Cosmos originated messaging, whose dominant operational risk proves to be relay eligibility rather than latency.

I. INTRODUCTION

Cross-chain bridges face atomicity risks across heterogeneous chains and semantic mixing of domain-specific tokens. The proposed bridge combines an HTLC transfer protocol with an automatic source-burn callback and deterministic, mirrored class identities.

I. INTRODUCTION

  • Environmental tokens can encode distinct methodologies or units, so fungible bridging can erase meaningful distinctions between classes.The introduction cites the BCT pool as an application-layer example of heterogeneous credits aggregated into one fungible token.Source: §I · p. 1
  • Classical two-phase commit requires a trusted coordinator, while HTLCs can face a timeout race when relay latency stretches across heterogeneous ecosystems.The paper identifies the simultaneous treatment of atomicity and semantic preservation for multi-class tokens across EVM–Cosmos as an unmet need.Source: §I · p. 1
  • An automatic callback relays the destination claim’s revealed secret back to the source, where it burns the escrow and closes the timeout-race window in bounded delay.The lock-time bounty makes the fallback burn incentive-compatible.Source: §I · pp. 1–2
  • Deterministic indicator identities, mirrored class registries, and mint-time checks prevent semantic mixing; a lock-time bounty makes fallback source burns incentive-compatible.The design adapts HTLCs from two-party exchange to single-owner burn-and-mint transfer.Source: §I · p. 2
  • 97 s median latency across 50 Polygon→Neutron transfers over 7 days, with all transfers completed by the automatic callback; reverse-direction validation completed in 93 s.Semantic-validation overhead stayed below 0.4% of cross-chain messaging cost.Source: §I · p. 2

A. Cross-Chain Transactions, Relayers, and Bridges

The background frames bridge design around cross-ledger relaying, atomic settlement, and preserving environmental-token classes. Its system assumptions distinguish relay authenticity and delivery from the live observer needed if the callback fails.

A. Cross-Chain Transactions, Relayers, and Bridges

  • A cross-chain transaction relies on an external relayer because neither ledger natively observes the other; supply can be reconciled through burn-and-mint or custodial lock-and-mint.The paper chooses burn-and-mint.Source: A. Cross-Chain Transactions, Relayers,… · p. 2

B. Hash Time-Locked Contracts and the Timeout Race Condition

  • When a destination claim lands near its HTLC deadline and secret propagation exceeds the remaining source-refund margin, a user may claim on the destination and still refund on the source.Two-phase commit removes this race through a trusted coordinator, while HTLCs avoid that coordinator assumption.Source: B. Hash Time-Locked Contracts and the… · p. 2

C. Environmental Indicator Tokens

  • Environmental indicator classes carry units, methodology, and commitments to profile and evidence documents; fungibility holds within a class, not across classes.The design uses ERC-1155 token IDs on the source and a mirrored destination registry.Source: C. Environmental Indicator Tokens · p. 2

D. System Model and Assumptions

  • The safety-property table marks A4 as conditional only in callback-failure cases; A4 requires a rational, live observer to invoke the source-side burn before the deadline.The protocol-enforced bounty is sized above the monitor’s execution cost; message authenticity is separately assigned to A6.Source: D. System Model and Assumptions · pp. 2–3, Table I · p. 3

III. RELATED WORK

Related work is organized around protocol formalisations and standards, with the comparison framed by five proposed features. The paper distinguishes cryptographic HTLC-based transfer and semantic preservation from trusted-gateway or single-denomination approaches.

A. Cross-Chain Protocol Formalisations

  • The related-work comparison uses five features, while prior HTLC formalisations address fungible swaps and the surveyed systems do not identify semantic preservation.The paper says its protocol addresses the timeout race and assumed semantic equivalence, and notes that implementation-level verification remains open.Source: A. Cross-Chain Protocol Formalisations · p. 3, §III · p. 3

B. Protocol Specifications and Standards

  • SATP targets burn-and-mint transfers through trusted gateways executing 2PC, while IBC’s ICS-20 and ICS-721 do not provide the multi-class semantics and HTLC atomicity at issue.The paper uses IBC indirectly through Axelar and adds cryptographic class-identity binding and HTLC atomicity.Source: B. Protocol Specifications and Standards · p. 3
  • Table II compares cross-chain approaches against F1–F5; “No” means a feature is absent as a protocol-layer primitive, though F1–F2 may be composed above general-purpose messaging bridges.The comparison includes deployed systems and protocol specifications.Source: Table II · p. 3, B. Protocol Specifications and Standards · p. 3

C. Production Bridge Systems

The related-work discussion contrasts production bridges and tokenised environmental assets with the proposed feature set. The system-design overview describes a relay- and contract-environment-agnostic architecture, with a five-step happy path from escrow to source burn.

C. Production Bridge Systems

  • Surveyed production bridges support fungible, typically single-class tokens but provide none of F1–F5 as built-in primitives; the paper identifies no surveyed approach that preserves domain-specific semantics across transfer.General-purpose messaging can compose F1–F4 at the application layer, but the surveyed systems do not offer them natively.Source: C. Production Bridge Systems · p. 3

D. Tokenised Environmental Assets

  • Toucan and KlimaDAO distinguish broad credit categories, but the paper says neither cryptographically binds classes to methodology and evidence nor addresses semantic-preserving cross-chain transfer.The comparison cites Toucan’s pooled BCT and NCT assets.Source: D. Tokenised Environmental Assets · p. 3

IV. SYSTEM DESIGN

  • The happy path escrows tokens, relays a prepare message, reveals the secret and mints at destination, then uses an automatic callback to burn source escrow.The design requires only destination state, contract calls, and inbound and outbound relayed messages.Source: Figure 1 · p. 4, §IV · p. 4

A. Architecture Overview

The bridge combines relay messaging with an HTLC transfer protocol and automatic source burn after destination claim. Content-addressed indicator identities and mirrored registries preserve class meaning, while the transfer flow coordinates escrow, mint, callback, and refund.

A. Architecture Overview

  • The source multi-token contract holds class definitions and balances; the source bridge handles escrow and messages, while the destination receiver validates classes, mints, and emits callbacks.The relay authenticates messages but cannot claim without the secret or mint into unregistered classes; its unavailability affects liveness only.Source: A. Architecture Overview · p. 4

B. Indicator Token Model: Preventing Semantic Mixing (F3, F5)

  • Each indicator’s identity is keccak256(profileHash), derived from a profile and evidence commitments so both chains can reproduce the same class identity without coordination.Token metadata binds each source tokenId to one indicatorId, and the destination registry mirrors the metadata; fungibility holds within a class, never across classes.Source: B. Indicator Token Model: Preventing… · p. 4

C. End-to-End Flow

  • For transfer, the source escrows tokens and sends a prepare message; a valid destination claim mints to the recipient and reveals the secret for the source-burn callback.If the destination claim is not made before Tc, anyone can cancel the pending mint after Tc and the sender can recover escrow and bounty after Te. The callback shortens source-chain ignorance to one relay hop; conservation depends on callback delay staying materially below ∆T.Source: C. End-to-End Flow · p. 4

D. Protocol State Machine, Invariants, and Semantic Preservation

The protocol models each transfer as paired source and destination state machines with guarded transitions and terminal outcomes. Its invariants capture single settlement, supply conservation, and semantic preservation, with supply conservation depending on the rational-monitor assumption when callbacks fail.

D. Protocol State Machine, Invariants, and Semantic Preservation

  • Source and destination states advance through guarded lock, prepare, claim, burn, and refund transitions; terminal states reject duplicate or replayed messages without state change.The state model defines I1 as single settlement, I2 as no simultaneous source refund and destination mint, and I3 as a mint backed by an equal-amount lock of the same indicator identity.Source: D. Protocol State Machine, Invariants,… · p. 5
  • Under A1, A5, and A6, every destination mint of amount A follows a source escrow of amount A whose class commits to the same profile.The proof relies on minting only from a pending state, registered-class identity checks, on-chain identity reads at lock time, and matching profile hashes.Source: D. Protocol State Machine, Invariants,… · p. 5
  • Without A6, a forged prepare message can mint unbacked tokens into a registered class, but the class-identity guarantee still blocks mints into unregistered or mismatched classes.I2, and therefore per-transfer atomicity as I1 ∧ I2, requires A4 in the callback-failure regime; exhaustive model checking reports checks of I1–I3.Source: D. Protocol State Machine, Invariants,… · p. 5

V. PROTOTYPE IMPLEMENTATION

The prototype implements the bridge across Polygon and Neutron using Axelar GMP, with contracts for class registries, escrow, minting, and callbacks. The evaluation uses mainnet routes and examines transfer correctness, latency, cost, and failure behavior.

V. PROTOTYPE IMPLEMENTATION

  • The prototype pairs Polygon EVM contracts with Neutron CosmWasm contracts and uses Axelar GMP as the relay; the destination component requires inbound verification, hashlock-indexed state, and outbound messaging.The design can also be implemented in another environment with those capabilities.Source: §V · p. 5
  • Polygon’s BridgeHTLC enforces minimum timelock and bounty requirements, while Neutron’s receiver checks sender authorization and requires the message identity to match the registered class identity.The source contract exposes claimBurn and refundBurn; the destination maintains a mirrored registry and hashlock state.Source: §V · p. 5
  • Cosmos-originated callbacks and reverse prepares require fee-refunder fees, an explicit Axelar relayer fee naming the fee collector, and fees denominated in an Axelar-registered asset.The prototype uses AXL for the relayer fee; unregistered denominations such as NTRN are error-acknowledged and refunded.Source: §V · p. 5

VI. EVALUATION

  • The evaluation uses Polygon and Neutron mainnets with default Axelar finality and asks about atomicity, semantic consistency, latency, costs, and safety and liveness under failure modes.Transfers use Te = 2 h and ∆T = 30 min; transaction hashes are published for independent verification.Source: §VI · p. 6

A. Atomic Transfer Results

Mainnet transfers completed automatically in both directions, and a 50-transfer Polygon-to-Neutron campaign characterized latency. Relay fees dominate user costs, while semantic validation adds only a small share of the source transaction cost.

A. Atomic Transfer Results

  • 108 s for EVM→Cosmos and 93 s for Cosmos→EVM were fully automatic representative transfers, with source burn executed after the destination claim callback.The measured legs were 34 s prepare, about 1 s claim, and 62 s callback for EVM→Cosmos; reverse legs were 55 s, about 1 s, and 31 s.Source: A. Atomic Transfer Results · p. 6
  • 97 s median and 141 s p95 latency across 50 Polygon→Neutron transfers; all runs completed through the automatic callback, with none requiring manual fallback.The campaign spanned 7 days; p90 was 122 s and maximum latency was 164 s, far below the 30-minute ∆T. Figure 2 presents the empirical latency CDF.Source: A. Atomic Transfer Results · p. 6, Figure 2 · p. 6

B. Transaction Costs

  • The two relay fees dominate user-paid transfer costs, which were about US$1–2 per transfer at representative campaign prices; refund operations recover escrow and bounty.The source relay fee is about 1 POL and the callback relay fee about 1 AXL; destination fee-refunder fees are 0.4 NTRN, half refunded on success.Source: B. Transaction Costs · p. 6

C. Cost Decomposition: Where Does the Overhead Go?

  • Under 0.4% of lockForBurn’s total cost is semantic-integrity validation, while Axelar GMP accounts for about 56% of gas.The identity read and 64-byte payload cost about 2,100 gas, compared with about 345,000 gas for Axelar GMP.Source: C. Cost Decomposition: Where Does the… · p. 6

D. Failure-Mode Analysis: Safety and Liveness

The protocol handles relay and callback failures through refunds, public-secret recovery, and a bounty-backed monitor path, while class checks reject unregistered tokens. Its security argument and TLC results make supply conservation conditional on a rational observer acting before the source refund deadline after callback failure.

D. Failure-Mode Analysis: Safety and Liveness

  • During deployment, a callback with an invalid relayer fee went unexecuted, but a monitor collected the bounty and recovered the escrow 1,258 s after lock.Other observed paths included recovery by refundBurn after an undelivered prepare and an atomic abort under invalid IBC fees.Source: D. Failure-Mode Analysis: Safety and… · p. 7

E. Security Argument

  • P1 depends on A1 and A2, P2 also depends on A3 and A6, and P3’s class-identity guarantee depends on A1 and A5.A6 is additionally required for Theorem 1’s amount-backing clause.Source: E. Security Argument · p. 7
  • Modes (a), (b), (d), and (e) preserve all three properties: failed preparation is refundable, observers can burn after a revealed claim, and invalid secrets or classes are rejected.The strict 32-byte preimage check rules out accepted alternate secrets; an unregistered or mismatched class creates no destination state.Source: E. Security Argument · p. 7, D. Failure-Mode Analysis: Safety and… · p. 7
  • A callback failure without a monitor before Te is the sole failure mode that permits a destination mint and source refund, violating P1 and P2.P1 and P2 hold in this regime only if at least one observer submits claimBurn before Te; the corrective interval is at least 30 minutes.Source: D. Failure-Mode Analysis: Safety and… · p. 6, E. Security Argument · p. 7
  • Without A4, TLC finds an 11-state counterexample violating I2; with the rational-monitor guard, all invariants hold across 145 states.The model covers one transfer with a faulty but non-Byzantine relay; it does not verify monitor liveness or forged-mint violations of P2.Source: E. Security Argument · p. 7

VII. DISCUSSION

The discussion finds semantic validation inexpensive relative to messaging, but callback safety remains conditional and operational failures center on relay eligibility. It explains the bounty and minimum-bounty design, then contrasts the bridge’s trust and semantic guarantees with existing approaches.

A. Critical Analysis of the Results

  • Every transfer in the 50-transfer campaign completed automatically, but callback messages with missing or wrongly denominated fees could be routed without execution.The authors identify relay eligibility, rather than latency, as the dominant callback-path operational risk; semantic mixing is prevented at bridge level only, since downstream pooling can recreate it.Source: A. Critical Analysis of the Results · pp. 7–8

B. Weak Supply Conservation: A Conditional-Safety Property

  • The bountied callback pays any valid claimBurn submitter, making a rational observer motivated to restore supply conservation after callback failure.A pull-payment fallback prevents payout failure from blocking settlement.Source: B. Weak Supply Conservation: A… · p. 8
  • The protocol enforces b ≥ bmin on both chains because an optional bounty lets a sender sabotage the callback and profit by refunding.The default minimum is 0.05 POL, set above monitor execution cost; accountable watchtowers and native IBC callbacks remain future work.Source: B. Weak Supply Conservation: A… · p. 8

C. Comparison with Existing Approaches

  • The callback leg has a 47 s median and 79 s p95 when correctly funded, but fee-eligibility failures can stall it indefinitely.The callback reduces the timeout-race exposure relative to the 30-minute corrective interval, while making the bountied monitor path load-bearing.Source: C. Comparison with Existing Approaches · p. 8
  • SATP uses trusted 2PC gateways, while validator-quorum bridges assume honest-majority message authenticity; the latter cannot cross class boundaries under this design.The authors note that these alternatives do not preserve domain-specific semantics, so unmodified use for indicator tokens could reproduce the BCT failure mode.Source: C. Comparison with Existing Approaches · p. 8

D. Implications

The bridge is positioned for periodic environmental-asset workflows, but its deployment and verification scope remains bounded. The conclusions highlight the automatic callback with bounty and deterministic indicator identity as the two core contributions.

D. Implications

  • 97 s median latency, US$1–2 per transfer, and <0.4% semantic overhead support periodic environmental-asset workloads, but not high-frequency movement.The indicator-identity construction is also described as domain-agnostic for other multi-class assets, with essentially zero added gas.Source: D. Implications · p. 8

E. Limitations

  • The prototype covers Polygon–Neutron over Axelar, while implementation-level verification remains open and the ≥30-min monitoring window still requires a live observer.Latency characterization covers EVM→Cosmos (n = 50); reverse-direction validation is end-to-end but based on n = 2.Source: E. Limitations · p. 8

VIII. CONCLUSIONS AND FUTURE WORK

  • The conclusions identify an automatic callback with an escrowed minimum bounty and a deterministic indicator identity as the two contributions addressing atomicity and semantic mixing.The authors report fully automatic bidirectional transfers over 50 runs across 7 days, with a 97 s median, and propose native IBC callbacks, DAO-governed class registration, and implementation-level verification as future work.Source: §VIII · p. 8
Loading 2610.37663v1…