Bridge overview.

LayerZero V2          Generic omnichain messaging, OFT transfers, mandatory Tenzro DVN
Chainlink CCIP        Token transfers with Cross-Chain Token (CCT) v1.6+ standard
Chainlink Data Feeds  Price feeds (AggregatorV3, latestRoundData)
Chainlink Data Streams Sub-second market data for equities, FX, commodities, crypto
Chainlink PoR         Reserve attestations for Secure-Mint policies
deBridge DLN          Intent-based cross-chain liquidity
LI.FI                 Aggregator across 130+ chains
Wormhole + NTT        Generic messaging, Guardian VAA verification, Native Token Transfers
Hyperlane V3          Sovereign Tenzro-validator-set ISM, 18+ chains
Axelar GMP            30+ chains including Cosmos, Move, Stellar, XRP Ledger, Hyperliquid
Babylon               Bitcoin staking, BTC-secured finality providers
Canton 3.5+           Tokenized RWA, CIP-56 Canton Coin, DAML DvP

The BridgeRouter picks an adapter given a source chain, destination chain, asset, and amount. Strategies: LowestFee, FastestTime, Balanced, PreferAdapter, LiFiAggregator, and Regulated. The router consults live fee quoting (LayerZero EndpointV2.quote(), Chainlink Router.getFee(), deBridge order-creation API, Canton fee schedule from the live Splice.AmuletRules:AmuletRules active contract) and returns a ranked set of options. Every quote is fresh, every route is signable, every settlement is checkpointed.

Regulated filters routes to adapters that declare BridgeAdapterClass::RegulatedRail — currently ChainlinkCcipAdapter (OCR commit-store + RMN ARM verification) and WormholeAdapter (Guardian quorum) — then picks the cheapest among those. When no RegulatedRail adapter covers the lane, the router falls back to lowest-fee across all routes. Call tenzro_ccipBridge directly to pin the route to CCIP and refuse the fallback.

• tenzro_bridgeQuote — live fee + ETA quote across configured adapters for a given route.
• tenzro_bridgeRoutes / tenzro_getBridgeRoutes — list available routes between a source and destination.
• tenzro_bridgeTokens — execute a token bridge using the chosen route.
• tenzro_bridgeWithHook — execute and trigger a destination-chain hook.
• tenzro_bridgeStatus — track in-flight messages by route identifier.

Every adapter verifies inbound outer-envelopes against its configured trust source. Verification is fail-closed: a message that does not match the configured trust source is rejected before any state mutation.

• Wormhole. VAA quorum verification against the configured Guardian set using secp256k1 ECDSA recovery and the canonical Wormhole signing digest.
• Hyperlane. Sovereign Tenzro-validator-set ISM with k-of-n multisig verification over the canonical Mailbox encoding (version || nonce || origin || sender || dest || recipient || body); message id is SHA-256 over the encoding.
• Axelar. Threshold validator-set multisig over the canonical GMP envelope; payload hash as the GMP correlation id.
• LayerZero, Chainlink CCIP, deBridge, LI.FI. Adapter-specific verification per the protocol's published contract — DVN attestation, CCIP commit-store + RMN ARM, deBridge order signature, LI.FI aggregator passthrough.
• Canton. Source-party signature on the inbound JSON Ledger payload; receipts mirror back through the Canton mirror surface.

The trailing ISM-metadata wire format (Hyperlane and Axelar) is body || u8 sig_count || sig_count * (addr20 || sig65). Per-adapter nonce trackers persist replays across node restarts.

For every adapter, the fee is the sum of:

• Source-chain gas (paid in the source chain's native asset)
• Destination-chain gas (paid by the relayer/keeper)
• Adapter-specific fee (LayerZero DVN, CCIP, deBridge order, Wormhole relayer, etc.)
• Tenzro protocol fee — a configurable basis-point fee on the routed amount

The Tenzro protocol fee routes to the treasury leg of the standard revenue split. Quotes carry a TTL; stale quotes are rejected.

Bridge fee sponsorship pools subsidize cross-chain settlements for eligible end-user and agent flows. Funded by operator contributions, a configurable share of the treasury leg on subsidized routes, and treasury grants. Routes that are eligible draw from the pool automatically. Sponsorship is on-chain and exposed via tenzro_listBridgeSponsorshipPools.

Every cross-chain message carries a nonce. The recipient adapter checks that the nonce is fresh against the persistent per-adapter nonce tracker (CF_SETTLEMENTS / bridge_nonce:<adapter>:*). A replayed nonce is rejected. The nonce tracker survives node restarts so replays do not become valid after an operator-induced restart.

Per-adapter seen_messages sets (e.g. Wormhole VAA hashes) provide a second deduplication layer against pathological replays that share a nonce class.

Users sign an open order on the source chain; a filler picks it up on the destination chain; the order id is SHA-256("tenzro/7683/order" || swapper || nonce_le || origin_chain_id_le || fill_deadline_le || order_data_type || order_data) and is persisted in CF_SETTLEMENTS under the 7683_origin: keyspace. Fill-side idempotency is tracked under 7683_dest:.

• tenzro_open7683Order, tenzro_get7683Order, tenzro_list7683Orders
• tenzro_recordFill7683, tenzro_getFill7683, tenzro_listFills7683

Order state walks Open → AwaitingProof → Settled / Refunded / ForceRefundEligible. Proof routes are LayerZero, Wormhole, deBridge, or Hyperlane.

• tenzro_erc7802CrosschainMint, tenzro_erc7802CrosschainBurn, tenzro_erc7802GetCrossChainSupply — native cross-chain token mint and burn.
• tenzro_cctListPools, tenzro_cctGetPool, tenzro_cctBuildMessage — Chainlink CCT v1.6+ LockRelease and BurnMint pool registry.

For destination chains that require a single signing key (every EVM destination), the bridge signer can be backed by a t-of-n threshold ECDSA key share split across staked tier-2 validators rather than a single raw key. The bridge crate uses a chain- and transport-agnostic ThresholdSigner trait; the node implements it over the libp2p MPC surface using DKLS23 secp256k1.

Signer backends: RawKey, SealedKey (TEE-sealed), ThresholdKey. Dispatch priority is mpc_threshold → tee_sealed → raw/env. All EVM-family adapters pick up threshold signing automatically when configured.

The threshold key is established by a distributed key generation ceremony before any adapter is configured. Every participating operator calls tenzro_mpcKeygen with identical parameters — the sorted set of participant DIDs, the threshold and total party count, a shared finalized_block_hash (64-hex, a finalized HotStuff-2 block hash) and a shared session_nonce (64-hex) — so the derived session identifier is byte-identical across parties, plus peer_bindings mapping each participant DID to its libp2p peer id for round routing. The call starts a background session and returns immediately; operators poll tenzro_mpcKeygenStatus until the session reports completed. Both methods are admin-token-gated.

On completion the session record carries the group_id, the SEC1-compressed group_public_key, the epoch, and the EIP-55 address — the exact fields pasted into BridgeAdapterConfig.mpc_threshold. Each operator holds a TEE-sealed key share persisted to CF_MPC_KEYSHARES; the session registry itself is ephemeral orchestration state, the sealed share is the durable artifact. Operators restart the node after pasting the configuration so the adapter picks up the threshold backend.

• tenzro_authorizeBridge, tenzro_authorizeCrosschainBridge — admin-token-gated.
• tenzro_revokeBridge — tear down an authorized bridge.
• tenzro_updateBridgeLimits — adjust per-bridge limits.
• tenzro_setBridgeFeeRate, tenzro_sponsorBridgeFee, tenzro_quoteBridgeFeeInTnzo — manage the protocol fee, sponsorship pool contributions, and TNZO-denominated fee quoting.
• tenzro_listAuthorizedBridges, tenzro_listBridgeAdapters — discovery.
• tenzro_getBridgeAnalytics, tenzro_listBridgeAnalytics — per-bridge call counters and cumulative volume.
• tenzro_mpcKeygen, tenzro_mpcKeygenStatus — establish and poll a threshold-signer DKG session. Admin-token-gated.