A brand new set of machine-checked proofs printed on Ethereum Analysis on July 21, 2026, pushes the formal concept of cross-domain state preservation meaningfully ahead — and the implications stretch properly past tutorial verification. The work mechanizes the composition of preservation maps between synchronization domains and stratifies them by coupling breadth, utilizing Isabelle/HOL because the proof engine. What comes out the opposite finish isn’t just a group of theorems however a reusable, sorry-free verification foundation that any bridge, rollup exit, shared sequencer, or permissioned settlement leg can instantly discharge.
Key takeaways
- Preservation maps between state machines type a full class — id, composition, and associativity are all machine-checked in Isabelle/HOL.
- The regulatory state machine runs over 5 states, seven actions, and twelve legitimate transitions, encoding authorized motion semantics instantly into the transition relation.
- Synchronization power is modeled as a tower of functors graded by chain breadth; forgetting the topmost chain holdings is proved to be a pure transformation.
- The mechanization is launched as a sorry-free Isabelle/HOL construct and is publicly obtainable.
Mechanized Composition of Preservation Maps and Class Construction
The central formal result’s easy to state and arduous to overestimate in significance: preservation maps between state machines type a class. Three theorems — preservation_id, preservation_compose, and preservation_assoc — give these maps id, closed composition, and associativity respectively, all verified by way of generic Isabelle/HOL locales over arbitrary state machines.
Why does class construction matter right here? As a result of it licenses link-at-a-time reasoning throughout arbitrarily lengthy chains of interoperating programs. In a sequence involving a rollup leg, a base layer, and a permissioned settlement leg, the end-to-end preservation map follows from the person hyperlinks with out requiring a brand new proof. Associativity means the grouping of hops is irrelevant to the assure. When an end-to-end property fails, not less than one per-link obligation should have failed — the decomposition organizes the prognosis, even when it doesn’t carry out it routinely.
The mechanization is constructed as a set of generic locales, which means the legal guidelines are instantly reusable by any area that discharges the locale obligations. That design alternative separates the formal framework from any particular protocol, making the idea moveable throughout the rollup ecosystem.
Modeling Regulatory State Transitions with a 5-State Machine
Regulatory transitions are usually not summary labels on this mannequin. The mechanized occasion runs over a five-state, seven-action house with twelve legitimate transitions out of a syntactically potential thirty-five motion pairs — and that sparsity is the purpose. A seizure utilized to an asset already in a confiscated state is legally meaningless; the mannequin rejects it on the transition relation moderately than leaving the constraint to runtime conference.
Authorized semantics mirrored in transition constraints
Escalation is directional, one state is terminal (formalized as confiscated_terminal), and preservation is handled as a heterogeneous-action locale interpretation. Preservation then carries concrete authorized weight: the impact a regulatory transition produces should survive the passage between domains. A frozen asset can’t arrive on the receiving aspect merely restricted.
The mechanization is intentionally scoped. A draft Requirements Observe proposal, ERC-8319, presently below assessment on Ethereum Analysis, gives the general public taxonomy of legally distinct actions that motivated this explicit occasion — however the mechanization doesn’t implement ERC-8319, and ERC-8319 mandates no particular state machine. The 2 layers are deliberately separate.
Synchronization Levels as a Tower of Functors Graded by Chain Breadth
Not each asset in a cross-domain system requires the identical synchronization power, and the functor tower formalizes that heterogeneity. The state house is graded by chain breadth: for every degree ok, a provider holds all international states whose asset holdings are supported on chains 0 by way of ok, anchored at hub chain 0. This provides one functor per degree, and the index formalizes what the mannequin calls coupling breadth.
Pure transformation theorem on forgetting topmost chain holdings
Between adjoining ranges, the map degree_forget drops the holdings of the topmost chain. The central theorem — degree_natural_transformation — proves this map is pure: forgetting the topmost chain holdings commutes with each regulatory transition. Composites of those projection maps are once more pure, so projection to any decrease degree is lawful in a single step or throughout many.
A concrete hint illustrates what this implies. Take an asset on chains 0 by way of 2 and a freeze listed to it. Making use of the freeze at breadth 2 after which forgetting chain 2 lands in the identical state as forgetting chain 2 first after which making use of the freeze at breadth 1. Projection to a narrower context can’t produce a regulatory historical past that contradicts the one the narrower context ought to have noticed. The work explicitly notes {that a} stay exit protocol with delays, retries, and membership adjustments is a candidate software of this legislation — and solely that; no particular protocol is claimed to refine the mannequin.
Mannequin Assumptions, Belongings’ Declared Levels, and Obtainable Artifacts
Single hub chain anchoring and implications for multi-hub situations
The naturality outcomes relaxation on a single-hub topology: hub chain 0 isn’t forgotten at any degree, and admissibility anchors to it all through. Nothing within the current framework speaks to multi-hub configurations or altering coupling topologies. That boundary isn’t a minor caveat — it’s a structural constraint on the place the present theorems apply.
Belongings carry mounted synchronization levels at issuance, with dynamic adjustments open
The mannequin handles static reassignment of levels between synchronization cycles, however diploma adjustments throughout a stay cycle stay explicitly exterior the mannequin. The theorems are agnostic about when a level is asserted; the product design studying — declaration at issuance — is one instantiation, not a theorem assertion. What occurs when an asset’s diploma adjustments whereas a synchronization cycle is in flight, and which diploma governs that cycle, is an open query the authors flag instantly.
Open Questions and Limitations in Cross-Area State Preservation
The authors are candid about the place the framework stops. 4 open questions are acknowledged explicitly, and they don’t seem to be peripheral — every represents a niche that limits the present mannequin’s scope in virtually necessary methods.
- Combination diploma guidelines: The place items with distinct declared levels share one asset identifier, which conservative aggregation guidelines are sound, and at what value to fungibility and expressiveness? The mechanization proves no multi-asset be a part of rule.
- Dynamic promotion: If a declared diploma adjustments whereas a synchronization cycle is in flight, which diploma governs that cycle and the place should the transition boundary be positioned?
- Multi-hub naturality: The current outcome preserves hub chain 0. What further construction would get better naturality throughout a number of hubs or a altering coupling topology?
- Obligation boundaries: Which legal guidelines belong in a public specification, which must be discharged by implementation-level conformance, and which stay design steerage?
The fungibility challenge deserves explicit consideration. The functor tower requires no per-lot provenance — naturality squares index transitions by regulatory motion, asset identifier, and chain breadth, monitoring nothing about which items got here from the place. Nevertheless it does presuppose a steady asset-level identifier with a well-defined diploma task. Commingling items of various declared levels below one identifier falls exterior the mannequin’s typing boundary. Two repairs are seen — bucketed identifiers or a conservative mixture diploma that dominates all unit declarations — however each carry prices: bucketed identifiers fracture fungibility till buckets retire, whereas a single mixture diploma widens obligations for a whole stability primarily based on its highest-degree part.
What the work finally contributes is a formally verified skeleton on which operational protocol hierarchies might be positioned — as soon as the refinement from chain breadth to operational diploma semantics is established. That refinement isn’t but executed. The skeleton is sound; constructing on it now requires figuring out precisely the place its ground ends.
FAQ
What’s the essential contribution of the mechanization offered?
It mechanizes the composition of preservation maps between state machines, proving they type a class with id, composition, and associativity — all verified in Isabelle/HOL — and stratifies them by coupling breadth utilizing a tower of functors.
How are regulatory state transitions modeled within the examine?
They’re modeled as a five-state, seven-action machine with twelve legitimate transitions, encoding authorized motion semantics instantly into the transition relation in order that legally meaningless operations — comparable to seizing an already-confiscated asset — are rejected on the mannequin degree moderately than left to runtime conference.
What does the tower of functors signify in synchronization levels?
It represents a graded construction of synchronization power listed by chain breadth, the place forgetting the topmost chain holdings is proved to be a pure transformation that commutes with each regulatory transition — which means projection to a narrower context can’t contradict the regulatory historical past that context ought to have seen.
What assumptions does the mannequin make concerning community topology and asset synchronization levels?
The mannequin assumes a single hub chain 0 because the topological anchor; multi-hub configurations and altering topologies are exterior the present outcomes. Asset synchronization levels are mounted at issuance and handled as static inside a cycle; dynamic diploma adjustments throughout stay synchronization cycles stay an open drawback.
Article produced with the help of synthetic intelligence and reviewed by the editorial staff.