mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
72 lines
3.0 KiB
TeX
72 lines
3.0 KiB
TeX
\section{System Model}
|
|
|
|
\label{sec:system}
|
|
% ============================================================
|
|
|
|
\subsection{Entities}
|
|
|
|
\begin{definition}[MPC Signer Set]
|
|
\label{def:signer}
|
|
A set $\Signer = \{s_1, \ldots, s_n\}$ of $n$ threshold signature nodes. A threshold $t \leq n$ defines the minimum quorum for valid signatures. The default configuration is $n = 3, t = 2$. The signer set authorizes mint and release operations via FROST~\cite{frost} (Ed25519/Schnorr chains) or CGGMP21~\cite{cggmp21} (secp256k1 chains).
|
|
\end{definition}
|
|
|
|
\begin{definition}[Sovereign Governor]
|
|
\label{def:governor}
|
|
For chain $\Chain_i$, the governor $\Gov_i$ is the on-chain address (DAO timelock, multisig, or single owner) that controls economic parameters of the bridge instance on $\Chain_i$. The governor is set by the chain's native token holders through their existing governance mechanism.
|
|
\end{definition}
|
|
|
|
\begin{definition}[OmnichainRouter Instance]
|
|
\label{def:router}
|
|
An immutable smart contract $R_i$ deployed on chain $\Chain_i$ that: (a)~verifies MPC threshold signatures, (b)~tracks per-source-chain nonce bitmaps, (c)~enforces fee caps and daily limits, and (d)~routes yield strategy deposits. Each instance is independently parameterized by its governor $\Gov_i$.
|
|
\end{definition}
|
|
|
|
\begin{definition}[Shariah Advisory Board]
|
|
\label{def:sab}
|
|
A $k$-of-$m$ multisig $\SAB$ of recognized Islamic finance scholars who classify yield strategies. The SAB operates independently of both the MPC signer set and chain governors.
|
|
\end{definition}
|
|
|
|
\subsection{Authority Domains}
|
|
|
|
Teleport cleanly separates three authority domains with non-overlapping capabilities:
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{@{}p{1.5cm}p{2.5cm}p{2.8cm}@{}}
|
|
\toprule
|
|
\textbf{Domain} & \textbf{Controller} & \textbf{Scope} \\
|
|
\midrule
|
|
Security & MPC signer set $\Signer$ & Mint/release authorization, signer rotation \\
|
|
\addlinespace
|
|
Economics & Chain governor $\Gov_i$ & Fees, limits, strategies, Shariah mode \\
|
|
\addlinespace
|
|
Protocol & Immutable code & Nonce checks, signature verification, fee cap \\
|
|
\addlinespace
|
|
Compliance & SAB multisig & Yield strategy Shariah classification \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Authority domain separation. No domain can override another.}
|
|
\label{tab:separation}
|
|
\end{table}
|
|
|
|
\subsection{Threat Model}
|
|
|
|
We assume a computationally bounded adversary $\mathcal{A}$ who may:
|
|
\begin{itemize}[nosep]
|
|
\item Compromise up to $t - 1$ MPC signer nodes
|
|
\item Capture the governor address on any single chain $\Chain_i$
|
|
\item Corrupt up to $k - 1$ SAB members
|
|
\item Observe and reorder transactions on any chain
|
|
\item Deploy malicious bridge instances mimicking Teleport
|
|
\end{itemize}
|
|
|
|
The adversary \emph{cannot}:
|
|
\begin{itemize}[nosep]
|
|
\item Compromise $\geq t$ MPC signer nodes simultaneously
|
|
\item Break ECDSA, Ed25519, or Schnorr hardness assumptions
|
|
\item Rewrite confirmed blocks on connected chains
|
|
\item Modify deployed immutable contract bytecode
|
|
\end{itemize}
|
|
|
|
% ============================================================
|