mirror of
https://github.com/zooai/proofs.git
synced 2026-10-30 14:49:47 +00:00
zeekayandHanzo Dev
638fba4c90
Bylines, paper authorship, correspondence addresses and the founder blurb under each post named an individual. They name the organisation that published the work instead: the brand on posts and pages, the research byline on papers, and research@ in place of a personal address. Both are what these repositories already used elsewhere — nothing new was coined. Co-authors are untouched. Where a paper named someone else alongside, they stay named; only the one byline changed. Bibliography entries, running heads, PDF metadata and affiliations move with it, so a citation still resolves to whoever the cited paper names. Sample and fixture data uses the placeholder name these tests already use elsewhere, so no assertion changed meaning. Co-authored-by: Hanzo Dev <[email protected]>
77 lines
2.4 KiB
Lean4
77 lines
2.4 KiB
Lean4
/-
|
|
Authors: Antje Worring, Zoo Labs Foundation Research
|
|
|
|
Bridge Token Safety
|
|
|
|
MPC-controlled bridge tokens (ZETH, ZBTC, ZUSD).
|
|
Minting requires threshold signature. Total supply is conserved.
|
|
|
|
Maps to:
|
|
- zoo/contracts/src/ZooBridgeToken.sol
|
|
- lux/mpc: CGGMP21 threshold keygen
|
|
- lux/threshold: FROST signing
|
|
|
|
Properties:
|
|
- Conservation: minted on dest = locked on source
|
|
- Threshold: mint requires t-of-n signatures
|
|
- No net creation of value
|
|
-/
|
|
|
|
import Mathlib.Data.Nat.Defs
|
|
import Mathlib.Tactic
|
|
|
|
namespace Contract.Bridge
|
|
|
|
/-- Bridge state: tracks locked (source) and minted (destination) -/
|
|
structure BridgeState where
|
|
locked : Nat -- tokens locked on source chain
|
|
minted : Nat -- tokens minted on destination chain
|
|
threshold : Nat -- t in t-of-n
|
|
signers : Nat -- n total signers
|
|
|
|
/-- Conservation invariant: minted ≤ locked -/
|
|
def isConserved (s : BridgeState) : Prop := s.minted ≤ s.locked
|
|
|
|
/-- Mint operation: requires threshold signatures -/
|
|
def mint (s : BridgeState) (amount : Nat) (sigs : Nat) : BridgeState :=
|
|
if sigs ≥ s.threshold then
|
|
{ s with minted := s.minted + amount, locked := s.locked + amount }
|
|
else s
|
|
|
|
/-- Burn operation: reduces minted and unlocks -/
|
|
def burn (s : BridgeState) (amount : Nat) : BridgeState :=
|
|
if amount ≤ s.minted then
|
|
{ s with minted := s.minted - amount, locked := s.locked - amount }
|
|
else s
|
|
|
|
/-- CONSERVATION: Minting preserves the invariant -/
|
|
theorem mint_preserves_conservation (s : BridgeState) (amount sigs : Nat)
|
|
(h : isConserved s) :
|
|
isConserved (mint s amount sigs) := by
|
|
simp [mint, isConserved] at *
|
|
split <;> simp_all <;> omega
|
|
|
|
/-- CONSERVATION: Burning preserves the invariant -/
|
|
theorem burn_preserves_conservation (s : BridgeState) (amount : Nat)
|
|
(h : isConserved s) :
|
|
isConserved (burn s amount) := by
|
|
simp [burn, isConserved] at *
|
|
split <;> simp_all <;> omega
|
|
|
|
/-- THRESHOLD: Minting below threshold is no-op -/
|
|
theorem mint_requires_threshold (s : BridgeState) (amount sigs : Nat)
|
|
(h : sigs < s.threshold) :
|
|
mint s amount sigs = s := by
|
|
simp [mint, Nat.not_le.mpr h]
|
|
|
|
/-- Initial state is conserved -/
|
|
theorem initial_conserved (t n : Nat) :
|
|
isConserved ⟨0, 0, t, n⟩ := by
|
|
simp [isConserved]
|
|
|
|
/-- Net supply is always zero (locked - minted = 0 when conserved and equal) -/
|
|
theorem no_net_creation (s : BridgeState) (h : isConserved s) :
|
|
s.minted ≤ s.locked := h
|
|
|
|
end Contract.Bridge
|