papers/lux-sovereign-defi/sections/06-white-label-architecture.tex

\section{White-Label Architecture}

\label{sec:whitelabel}
% ============================================================

\subsection{Shared Security, Sovereign Economics}

The white-label architecture enables any L1, L2, or application chain to deploy a sovereign bridge instance that:

\begin{enumerate}[nosep]
  \item Shares the security of the unified MPC signer set (no additional trust assumptions).
  \item Captures its own bridge fee revenue (not shared with other instances).
  \item Independently governs fees, limits, token listings, and compliance modes.
  \item Uses its own branding, domain, and user interface.
\end{enumerate}

\begin{figure}[h]
\centering
\begin{tikzpicture}[
  node distance=1.5cm,
  mpc/.style={rectangle, rounded corners, draw, fill=black!10, minimum width=5.5cm, minimum height=0.8cm, font=\small\bfseries},
  inst/.style={rectangle, rounded corners, draw, minimum width=2.2cm, minimum height=1.4cm, font=\scriptsize, align=center},
  arrow/.style={-{Stealth[length=2mm]}, thick, dashed},
]
  \node[mpc] (mpc) {MPC Signer Set ($t$-of-$n$)};

  \node[inst, below left=1.2cm and 0.8cm of mpc] (lux)
    {Lux C-Chain\\$\Gov_{\text{LUX}}$\\fees $\to$ xLUX};
  \node[inst, below=1.2cm of mpc] (zoo)
    {Zoo EVM\\$\Gov_{\text{ZOO}}$\\fees $\to$ ZOO};
  \node[inst, below right=1.2cm and 0.8cm of mpc] (wl)
    {Instance $N$\\$\Gov_N$\\fees $\to$ $V_N$};

  \draw[arrow] (mpc) -- (lux);
  \draw[arrow] (mpc) -- (zoo);
  \draw[arrow] (mpc) -- (wl);

  \draw[decorate, decoration={brace, amplitude=5pt, mirror}, thick]
    ([yshift=-0.2cm]lux.south west) -- ([yshift=-0.2cm]wl.south east)
    node[midway, below=0.3cm, font=\scriptsize] {Sovereign instances --- independent governance};
\end{tikzpicture}
\caption{White-label architecture. A single MPC signer set secures all instances. Each instance has independent governance and fee capture.}
\label{fig:whitelabel}
\end{figure}

\subsection{Deployment Process}

A new sovereign instance requires:

\begin{enumerate}[nosep]
  \item Deploy OmnichainRouter with the chain's governor address.
  \item Deploy bridge tokens (yTokens) for each supported asset.
  \item Register the instance with the MPC coordinator (permissionless).
  \item Configure fee rate, stakeholder vault, and optional compliance modes.
\end{enumerate}

The protocol layer is branding-agnostic: the same MPC attestation that works for Lux bridge tokens works for any sovereign instance's tokens. The MPC network does not distinguish between instances---it verifies lock events and produces signatures regardless of which instance emitted the event.

\subsection{Instance Isolation}

\begin{theorem}[Instance Isolation]
\label{thm:instance}
For sovereign instances $R_i$ and $R_j$ on chains $\Chain_i$ and $\Chain_j$ respectively:
\begin{enumerate}[nosep]
  \item $\Gov_i$ has no write access to any storage slot of $R_j$.
  \item Fee parameters $(f_b^{(i)}, f_s^{(i)})$ are stored locally in $R_i$ and read only by $R_i$.
  \item Nonce bitmaps in $R_i$ are indexed by source chain; processing a nonce in $R_i$ does not affect the bitmap in $R_j$.
\end{enumerate}
\end{theorem}

\begin{proof}
Each $R_i$ is an independent contract deployment on chain $\Chain_i$. By the EVM execution model, contract storage is isolated per address: $\texttt{SSTORE}$ and $\texttt{SLOAD}$ operate on the calling contract's storage trie. The \texttt{onlyGovernor} modifier restricts parameter writes to $\Gov_i$, which is an address on $\Chain_i$ with no ability to submit transactions to $\Chain_j$ (different chain, different address space). Nonce bitmaps are per-contract state, and processing $(C_s, \nu)$ in $R_i$ writes to $R_i$'s storage, which is inaccessible to $R_j$.
\end{proof}

% ============================================================