Bridge overview.

LayerZero V2          Generic omnichain messaging, OFT transfers, mandatory Tenzro DVN
Chainlink CCIP        Token transfers with Cross-Chain Token (CCT) v1.6+ standard
Chainlink Data Feeds  Price feeds (AggregatorV3, latestRoundData)
Chainlink Data Streams Sub-second market data for equities, FX, commodities, crypto
Chainlink PoR         Reserve attestations for Secure-Mint policies
deBridge DLN          Intent-based cross-chain liquidity
LI.FI                 Aggregator across 130+ chains
Wormhole + NTT        Generic messaging, Guardian VAA verification, Native Token Transfers
Hyperlane V3          Sovereign Tenzro-validator-set ISM, 18+ chains
Axelar GMP            30+ chains including Cosmos, Move, Stellar, XRP Ledger, Hyperliquid
Babylon               Bitcoin staking, BTC-secured finality providers
Canton 3.5+           Tokenized RWA, CIP-56 Canton Coin, DAML DvP

The BridgeRouter picks an adapter given a source chain, destination chain, asset, and amount. Strategies: LowestFee, FastestTime, Balanced, PreferAdapter, LiFiAggregator, and Regulated. The router consults live fee quoting (LayerZero EndpointV2.quote(), Chainlink Router.getFee(), deBridge order-creation API, Canton fee schedule from the live Splice.AmuletRules:AmuletRules active contract) and returns a ranked set of options. Every quote is fresh, every route is signable, every settlement is checkpointed.

Regulated filters routes to adapters that declare BridgeAdapterClass::RegulatedRail — currently ChainlinkCcipAdapter (OCR commit-store + RMN ARM verification) and WormholeAdapter (Guardian quorum) — then picks the cheapest among those. When no RegulatedRail adapter covers the lane, the router falls back to lowest-fee across all routes. Call tenzro_ccipBridge directly to pin the route to CCIP and refuse the fallback.

• tenzro_bridgeQuote — live fee + ETA quote across configured adapters for a given route.
• tenzro_bridgeRoutes / tenzro_getBridgeRoutes — list available routes between a source and destination.
• tenzro_bridgeTokens — execute a token bridge using the chosen route.
• tenzro_bridgeWithHook — execute and trigger a destination-chain hook.
• tenzro_bridgeStatus — track in-flight messages by route identifier.

Every adapter verifies inbound outer-envelopes against its configured trust source. Verification is fail-closed: a message that does not match the configured trust source is rejected before any state mutation.

• Wormhole. VAA quorum verification against the configured Guardian set using secp256k1 ECDSA recovery and the canonical Wormhole signing digest.
• Hyperlane. Sovereign Tenzro-validator-set ISM with k-of-n multisig verification over the canonical Mailbox encoding (version || nonce || origin || sender || dest || recipient || body); message id is SHA-256 over the encoding.
• Axelar. Threshold validator-set multisig over the canonical GMP envelope; payload hash as the GMP correlation id.
• LayerZero, Chainlink CCIP, deBridge, LI.FI. Adapter-specific verification per the protocol's published contract — DVN attestation, CCIP commit-store + RMN ARM, deBridge order signature, LI.FI aggregator passthrough.
• Canton. Source-party signature on the inbound JSON Ledger payload; receipts mirror back through the Canton mirror surface.

The trailing ISM-metadata wire format (Hyperlane and Axelar) is body || u8 sig_count || sig_count * (addr20 || sig65). Per-adapter nonce trackers persist replays across node restarts.

For every adapter, the fee is the sum of:

• Source-chain gas (paid in the source chain's native asset)
• Destination-chain gas (paid by the relayer/keeper)
• Adapter-specific fee (LayerZero DVN, CCIP, deBridge order, Wormhole relayer, etc.)
• Tenzro protocol fee — a configurable basis-point fee on the routed amount

The Tenzro protocol fee follows the standard commission split: 40% treasury / 30% burn / 30% stakers. Quotes carry a TTL; stale quotes are rejected.

Bridge fee sponsorship pools subsidize cross-chain settlements for eligible end-user and agent flows. Funded by operator contributions, a configurable share of network commission on subsidized routes, and treasury grants. Routes that are eligible draw from the pool automatically. Sponsorship is on-chain and exposed via tenzro_listBridgeSponsorshipPools.

Every cross-chain message carries a nonce. The recipient adapter checks that the nonce is fresh against the persistent per-adapter nonce tracker (CF_SETTLEMENTS / bridge_nonce:<adapter>:*). A replayed nonce is rejected. The nonce tracker survives node restarts so replays do not become valid after an operator-induced restart.

Per-adapter seen_messages sets (e.g. Wormhole VAA hashes) provide a second deduplication layer against pathological replays that share a nonce class.

Users sign an open order on the source chain; a filler picks it up on the destination chain; the order id is SHA-256("tenzro/7683/order" || swapper || nonce_le || origin_chain_id_le || fill_deadline_le || order_data_type || order_data) and is persisted in CF_SETTLEMENTS under the 7683_origin: keyspace. Fill-side idempotency is tracked under 7683_dest:.

• tenzro_open7683Order, tenzro_get7683Order, tenzro_list7683Orders
• tenzro_recordFill7683, tenzro_getFill7683, tenzro_listFills7683

Order state walks Open → AwaitingProof → Settled / Refunded / ForceRefundEligible. Proof routes are LayerZero, Wormhole, deBridge, or Hyperlane.

• tenzro_erc7802CrosschainMint, tenzro_erc7802CrosschainBurn, tenzro_erc7802GetCrossChainSupply — native cross-chain token mint and burn.
• tenzro_cctListPools, tenzro_cctGetPool, tenzro_cctBuildMessage — Chainlink CCT v1.6+ LockRelease and BurnMint pool registry.

For destination chains that require a single signing key (every EVM destination), the bridge signer can be backed by a t-of-n threshold ECDSA key share split across staked tier-2 validators rather than a single raw key. The bridge crate uses a chain- and transport-agnostic ThresholdSigner trait; the node implements it over the libp2p MPC surface using DKLS23 secp256k1.

Signer backends: RawKey, SealedKey (TEE-sealed), ThresholdKey. Dispatch priority is mpc_threshold → tee_sealed → raw/env. All EVM-family adapters pick up threshold signing automatically when configured.

• tenzro_authorizeBridge, tenzro_authorizeCrosschainBridge — admin-token-gated.
• tenzro_revokeBridge — tear down an authorized bridge.
• tenzro_updateBridgeLimits — adjust per-bridge limits.
• tenzro_setBridgeFeeRate, tenzro_sponsorBridgeFee, tenzro_quoteBridgeFeeInTnzo — manage the protocol fee, sponsorship pool contributions, and TNZO-denominated fee quoting.
• tenzro_listAuthorizedBridges, tenzro_listBridgeAdapters — discovery.
• tenzro_getBridgeAnalytics, tenzro_listBridgeAnalytics — per-bridge call counters and cumulative volume.