Whitepaper V4.1
11. Bridge Architecture and the Supply-Conservation Invariant
The bridge must never create an economic second supply of IONON. The invariant is:
Canonical economic IONON outstanding across all representations ≤ 100,000,000.
The exact mechanism depends on capabilities of the deployed ERC-20 and the final IONON Network token module. A burn-and-mint design is acceptable only if the Ethereum contract actually supports a safe, auditable burn path that cannot be abused. Otherwise, the bridge should use a lock/escrow-and-mint representation, with the locked Ethereum amount proving the maximum native representation that may exist.
The bridge controller must include:
- chain-specific canonical token registry;
- message uniqueness and replay protection;
- finality thresholds;
- rate limits and global mint/representation ceilings;
- validator/relayer separation;
- circuit breaker and pause at the bridge layer without requiring a pausable base token;
- independent monitoring;
- emergency reconciliation procedures;
- invariant checks before mint/release;
- transaction and proof retention;
- public bridge status dashboard.
Axelar GMP/Interchain infrastructure and IBC are candidates for interoperable transport. The product can still be branded “IONON Bridge” while proven messaging and transport are used underneath. Building an unaudited proprietary custodial bridge solely for branding would increase, not reduce, systemic risk.
11.1 Bridge state machine
Every cross-boundary movement should be modeled as a state machine rather than a pair of loosely coupled transactions:
Requested → Policy-checked → Source-finalized → Proof-observed → Destination-authorized → Mint/Release → Reconciled.
No transition is implicit. Each state carries a unique transfer identifier, source/destination chain IDs, amount, token identity, source block/finality checkpoint, proof or attestation reference, signer/validator set, policy version and timestamps.
A failed destination action must not cause a second source release. A reorg or duplicate message must not create a second mint. Emergency intervention may halt new bridge transitions, but it must never rewrite completed source-chain history.
11.2 Bridge risk budget
The bridge should launch with deliberately conservative limits: per-transfer caps, rolling per-hour/per-day ceilings, per-route ceilings and a global represented-supply ceiling. Limits can be increased only after observed reliability and governance approval. This is the same principle used elsewhere in IONON: autonomy grows with evidence, not optimism.
11.3 Monetary reconciliation
At each checkpoint the reconciliation service must prove:
Ethereum free + Ethereum escrowed + IONON Network canonical representation + any approved in-flight accounting adjustments = 100M economic cap, subject to defined representation rules.
A public dashboard should distinguish token supply, bridge escrow, circulating on each domain, and in-flight transfers so wrapped/escrowed balances are never double-counted in circulating-supply claims.