# Bridges What a “bridge” is (and what it isn’t) A bridge is how you show a fact or represent an asset on another chain—without breaking the single source of truth on EDMA. We keep one home for each claim: EDMA is canonical for PoV-backed units and milestone facts. Other chains may hold representations that must reconcile back to the claim\_id here. **Short rule:** EDMA home, others mirror. No bridge can bypass PoV, One-Claim, or No EMT, no funds. ### A. Scope * **Bridgeable** * EDM (ERC-20): canonical on EDMA; wrapped EDM on other chains via standard lock/mint or burn/mint. * Tokens marketplace assets (Energy/Carbon/Attributes): wrapped representations only; the EDMA token remains canonical. * **Not bridgeable** * EDSD: platform-bound stable; exits use the cash-out module (bank rails), not bridges. * Trade milestones (EMTs) & EDSD slices: facts live on EDMA; you can relay proofs, but you don’t “bridge” money states off-rail. ### B. Outbound representations Goal: show an EDMA token somewhere else without letting it be double-used. 1. **Lock on EDMA** — the original token is locked (non-transferable) and tagged “exported”. 2. **Mint on destination** — a wrapped token (wToken) is minted 1:1 referencing the EDMA claim\_id and pov\_hash. 3. **Use on destination** — trade or use within that ecosystem as a representation. 4. **Return or settle:** * Burn on destination → Unlock on EDMA (repatriate). * Retire on destination → submit a finality proof back to EDMA; EDMA records a compensating retirement (append-only) and permanently locks/burns the original here. **Safety rails** * Wrapped tokens must carry the EDMA claim\_id; bridges enforce one active representation per claim. * If the destination can’t provide a finality proof, the retirement must be executed on EDMA; destination burns only annotate. **Fees & burns** * No protocol fee/burn for the act of bridging. * Fees/burns remain tied to settlement/retirement. If retirement is finalized on EDMA (home), the 4% fee and 50% EDM burn occur here. If destination retires with a valid finality proof, EDMA records a compensating retirement; economic accounting remains single-sourced to EDMA’s ledger. ### C. Inbound proofs/representations * **Inbound proof (no representation):** an external chain proves a retirement or claim that EDMA recognizes as equivalent to a mirror (Section 13.1). EDMA links it to a single claim\_id, freezes duplicates, and records a compensating entry if needed. * **Inbound wrapped token:** a foreign representation burns there and mints the canonical token here, bound to a claim\_id. First-seen inside EDMA still applies: the first finalization here wins; later attempts link or are refused. **Invariants** * EDMA never creates two independent claims for the same fact. * All inbound actions must bind to one claim\_id (or be refused). ### D. Message security & finality * **Finality:** outbound unlocks and inbound mints wait for destination economic finality (e.g., challenge window for optimistic targets; validity/confirmed block depth for zk/POS targets). * **Bridging proofs:** * Native bridge (recommended): EDMA’s canonical bridge contracts verify proofs using light-client libraries or trusted connectors under governance. * Third-party bridges: allowed only if governance approves their proof model; all messages are tagged with nonce, domain, `claim_id`, `pov_hash` and checked for replay. * **Replays/doubles:** One-Claim on EDMA still prevents duplicate finalizations even if a bridge misbehaves. The second inbound for the same claim\_id is a no-op and raises a conflict flag. ### E. First-seen interplay Bridges follow the first-seen rules (Section 13.2): EDMA measures first-seen by finalization here. External timestamps inform freeze/replace decisions but don’t override EDMA’s claim\_id ownership. If a foreign chain presents a prior finalization, EDMA treats it like a registry mirror—binds or freezes until corrected—never as a second on-EDMA claim. ### F. Failure modes & recovery * **Stuck destination / paused bridge:** representations remain locked at origin; no unlock without proof of burn. Ops can escalate via governance; EDMA can mark the representation as FROZEN and offer re-mint via an alternate path once proof is provided. * **Conflicting inbound proofs:** EDMA freezes, opens a revocation case, and requires the external system to resolve—append-only lineage records the fix. * **Bridge compromise:** governance can revoke the connector, freeze all pending messages from that domain, and require alternative proofs (status page + inclusion lists keep settlement flows alive on EDMA). ### G. What you can bridge | **Item** | **EDMA role** | **Bridge action** | **Notes** | | ----------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------- | | **EDM** | Native ERC-20 | Lock on EDMA → Mint on dest; Burn on dest → Unlock on EDMA | Standard token bridge; not tied to PoV | | **Token (Energy/Carbon/Attr.)** | Canonical on EDMA | Lock on EDMA → Mint wrapped on dest; Burn proof → Unlock or Compensating retire | Always bound to claim\_id | | **EMT / EDSD state** | Non-transferable fact / platform stable | Not bridged | Relay proofs only; money states remain on EDMA | | **Proof (attestation, retirement)** | Evidence/meta | Relay proof → Mirror/annotate on EDMA | No value created; no fees | ### H. API & events * `POST /v1/bridge/export` — lock a token on EDMA; emits export ref; destination mints wrapped token. * `POST /v1/bridge/import` — present foreign burn/finality proof; EDMA unlocks or mints canonical token. * `GET /v1/bridge/status/{ref}` — state machine: LOCKED | MINTED\_DEST | BURNED\_DEST | UNLOCKED\_OR\_CANONICAL. **Webhooks:** * `bridge.export.locked` — token locked at origin (claim\_id, token\_id). * `bridge.import.minted` — canonical on EDMA (or unlocked). * `bridge.message.frozen` — message ignored (revoked connector / replay) with reason. * `bridge.conflict.opened` — inbound proof conflicts; mirror/freeze path started. ### I. Governance knobs * Approve/revoke bridge connectors and light-client libraries; rotate keys; publish slippage/timeouts for conversion related to burn half (Fee Router handles burns; bridges don’t). * Set domain allowlists, message nonce windows, max message age, and fail-safe behavior (freeze vs ignore). * Cannot weaken: PoV, One-Claim, must-fund, Locked→Unlocked on proof, 50% burn. ### J. Operator checklist * Treat EDMA as home for PoV assets; bridge only when there’s a compelling venue need. * Expect lock on origin before mint elsewhere; expect burn proof before unlock. * For retirements, prefer EDMA; if retiring elsewhere, ensure a finality proof comes back so EDMA records the compensating entry. * Never bridge EDSD; use cash-out after schedule completion. ### Plain recap {% hint style="info" %} Bridges let you show EDMA’s facts and assets on other chains without creating second truths. Tokens export as wrapped assets tied to EDMA’s claim\_id; unlocks require burn proofs; mirrors reconcile external serials one-to-one. EMTs and EDSD don’t bridge—money stays on-rail. Fees and 50% burns stay tied to settlement/retirement, not bridging. First to finalize on EDMA owns the claim here; everything else binds or freezes until it agrees. **One rail, one claim**—everywhere. {% endhint %}