The Bridge

A canonical 1:1 bridge, with its trust made visible

Assets are held in a dedicated vault on Ethereum while a fixed-supply representation moves through an isolated covenant lane on Minima. Bridge principal stays separate from fees, attestor bonds and voluntary security pools.

The project has executed valueless Minima covenant tests, but it is not a product, is not ready for real funds and has no production committee.

Why this structure

A multisignature custodian would be simpler but gives operators broad control. A liquidity-network bridge can be fast but depends on available market makers and does not preserve one canonical representation. A fully proof-verified bridge is the strongest target, but a complete Ethereum verifier has not yet been proved practical inside stock Minima limits.

The selected research design is hybrid: Ethereum-to-Minima facts are approved by a bonded threshold committee, while Minima-to-Ethereum aims to use a stateful consensus proof. Minima covenants restrict every valid output and enforce lane accounting, but they cannot tell whether a quorum-signed Ethereum claim is true.

The sensitive point: attestors

Attestors independently reconstruct the same finalized Ethereum fact, verify the lane, amount, recipient, deposit identity, vault state and prior bridge state, then sign the exact complete transition or refuse it. A benchmark uses five signatures from seven members. That number is not a production decision.

• Admission. Candidates disclose identity, control, technical capability, jurisdiction, conflicts and operating history. Every proposed member can opt out, and the candidate roster must be accepted by the selection group before activation.
• Independence. Seven keys controlled by one person are one operator, not decentralization. Hosting, ownership and decision-making diversity must be evidenced.
• Objective fault. Two incompatible signatures in one decision domain prove equivocation. A signed decision contradicted by an accepted finalized-chain proof can also be objective. Downtime and ambiguous forks require narrower governance and must not trigger automatic catastrophic slashing.
• Economics. Members place equal self-bonds at risk. Voluntary depositors may back one approved attestor and share that attestor's security-fee allocation, while accepting disclosed pool slashing risk. Deposits grant no signing or admission power.
• Limits. Aggregate bridge exposure must remain below a conservative value derived from slashable committee capital. Slashing is deterrence and possible recovery, not prevention: a valid quorum can still lie.

How a transfer is intended to work

• Ethereum to Minima. Deposit to the lane vault, wait for Ethereum finality, obtain a threshold decision, submit the exact Minima transition, then wait for Minima confirmation.
• Minima to Ethereum. Return the representation to its lane reserve, wait for Minima confirmation, prove the exact return to Ethereum, then release the vault payout.
• Failure handling. A refund must be tied to a provable cancellation state so a user cannot receive both a refund and a Minima release. Permanent source-chain failure remains a disclosed fund-trapping risk.
• Time. Completion time is source finality plus attestor collection or proof generation, relaying, destination inclusion and the selected late-fork safety margin. Exact production confirmation periods remain open.

Current status and source

P8 proved all five valueless Minima covenant branches for two isolated lanes. P9 remains incomplete because restored-key signing still needs a real global authority, independent monotonic checkpoint, strict node gateway, complete chain reconciler and measured network isolation. The prior signing domain is retired.