papers/lux-warp-v2/sections/01-introduction.tex

%% ====================================================================
\section{Introduction}
\label{sec:introduction}
%% ====================================================================

Lux is not merely adding post-quantum signatures to a chain; it defines a hybrid finality architecture for DAG-native consensus, with protocol-agnostic threshold lifecycle, post-quantum threshold sealing, and cross-chain propagation of Horizon finality.

This paper specifies the cross-chain leg of that thesis. Warp 2.0 evolves the Lux cross-chain messaging protocol (LP-021 \cite{lp021}, \texttt{github.com/luxfi/warp} \cite{warpgo}) to carry source-chain Horizon finality across chain boundaries via a Pulsar Pulse over a canonical envelope transcript. The receiving chain's verifier runs Prism over the source chain's transcript, producing a destination-side Horizon-final acceptance whose PQ root of trust resolves to the source's Pulsar GroupKey, not to a bridge or an oracle.

\subsection{Why Warp 2.0}

Warp 1.x is shipping (LP-021, LP-075 \cite{lp021,lp075}). It signs cross-chain messages with a BLS aggregate over the source chain's validator-key registry. The classical-only design has three structural shortcomings:

\begin{enumerate}[leftmargin=2em,nosep]
  \item \textbf{No post-quantum guarantee.} A quantum adversary that breaks BLS in polynomial time can forge a Warp 1.x envelope from any source chain to any destination, with no fallback PQ check. The destination has no cryptographic basis to discriminate honest from forged Warp 1.x bytes.
  \item \textbf{No source-finality binding.} A Warp 1.x envelope binds a source chain id, a payload, and a $\geq 2/3$-weight BLS aggregate. It does not bind \emph{when} on the source the message was finalized: the same source-chain validator set could sign multiple conflicting payloads, and Warp 1.x has no transcript field that anchors the message to a specific source-chain $\mathsf{NebulaRoot}$.
  \item \textbf{No source-key-era lineage.} A Warp 1.x envelope does not carry the source's $\mathsf{KeyEraID}$ / $\mathsf{Generation}$ tuple. A destination that wants to verify against the source's current key state has to reconcile the envelope's BLS aggregate against a registry view that may have shifted post-signing.
\end{enumerate}

Warp 2.0 fixes all three. The shape is direct: take the source-chain Horizon certificate (Beam + ML-DSA + Pulse, all bound to the source's $\mathsf{NebulaRoot}$ via the canonical \texttt{QuasarTranscript}); embed it in a cross-chain envelope; bind the envelope's signed $\mathsf{Message}$ to a single canonical digest $D$, which each lane signs under its own \texttt{LUX-WARP-ZAP-*} domain-separation tag; have the destination verifier run Prism over the source-chain transcript using the source-chain key registry. The result: a cross-chain envelope that, if Prism-accepted, is post-quantum-sound under the same composition theorem (Theorem~\ref{thm:warp-v2-soundness}, Section~\ref{sec:soundness}) as its consensus cousin.

\subsection{Forward-only migration}

Warp 1.x and Warp 2.0 share the wire space. The discipline is forward-only:
\begin{itemize}[leftmargin=2em,nosep]
  \item A Warp 2.0 envelope begins with the 5-byte ZAP magic \texttt{"LWZP"}$\,\|\,$\texttt{0x01} followed by the kind byte \texttt{0x02}. A legacy Warp 1.x RLP decoder fed these bytes rejects: the leading \texttt{'L'} (\texttt{0x4c}) is below RLP's list-prefix floor (\texttt{0xc0}--\texttt{0xff}), so it is not a valid RLP list. This is the correct refusal: a legacy verifier cannot validate the ZAP transcript binding, so it must not act on the bytes.
  \item A Warp 2.0 receiver parses ZAP bytes with one parser, \texttt{ParseEnvelope} (magic, kind, then $\mathsf{Message}$, Beam, and the two PQ lanes). There is no in-band cross-version dispatcher: legacy RLP bytes are rejected at the magic check, never lifted. A locally-originated message with no Pulsar lineage is simply a $\mathsf{Message}$ with zero lineage fields and the two PQ lanes carried as empty \texttt{u32(0)} frames --- Beam-only semantics without a separate envelope version.
  \item Senders that must reach legacy v1-only verifiers emit legacy v1 bytes on the legacy channel; the ZAP channel is independent. The ZAP Beam signs \texttt{LUX-WARP-ZAP-BEAM-v1}$\,\|\,D$ over the full $\mathsf{Message}$ (lineage included), so it is \emph{not} bit-equal to a legacy v1 BLS aggregate over the old unsigned body --- the two channels are cryptographically as well as syntactically distinct.
\end{itemize}

There is no v1 $\leftrightarrow$ v2 negotiation. There is no protocol downgrade. There is no v3 reserved that ``maybe re-encrypts the wire.'' The only forward step from Warp 2.0 is Warp Private (FHE-encrypted payload, optionally Pulse-signed), which is orthogonal to v2 (Section~\ref{sec:warp-private}).

\subsection{What this paper specifies}

Section~\ref{sec:warp-evolution} traces the Warp version history (1.x $\to$ 1.5 hybrid $\to$ 2.0 Pulse-backed $\to$ Warp Private). Section~\ref{sec:envelope-format} gives the canonical wire format and cites the transcript-binding definition. Section~\ref{sec:cross-chain-binding} specifies the cross-chain binding fields ($\mathsf{sourceNebulaRoot}$, $\mathsf{sourceKeyEraID}$, $\mathsf{sourceGeneration}$) and the L1/L2/L3 transitive inheritance. Section~\ref{sec:soundness} states the cross-chain soundness theorem and its connection to Quasar Horizon. Section~\ref{sec:fuzz-vuln} documents the lattigo $\mathsf{ReadUint64Slice}$ DoS that the fuzz harness surfaced and that is fixed in production. Section~\ref{sec:warp-implementation} cites the running Go canonical (\texttt{warp/codec.go}, \texttt{warp/zap.go}, \texttt{warp/envelope.go}, \texttt{warp/pulsar/pulsar.go}) and the wire-format / lane-verification tests. Section~\ref{sec:warp-related-work} compares to CCIP, Wormhole, IBC, and LayerZero, with emphasis on the Pulse-backed PQ source finality angle.

\subsection{What this paper does not do}

We do not specify the source-chain Horizon construction (that is \cite{luxquasarhorizon}). We do not specify Pulsar (that is LP-073 \cite{lp073,luxpulsar}) or LSS (that is \cite{luxlssmpc,lp077}). Where the underlying threshold mathematics is needed, we cite the canonical proof-bucket files (\texttt{proofs/quasar/warp-pq-soundness.tex}, \texttt{proofs/pulsar/unforgeability.tex}, \texttt{proofs/definitions/transcript-binding.tex}). We do not duplicate proof bodies; we cite them.