Formal proofs advance cross-domain state preservation for bridges and rollups

A new set of machine-checked proofs published on Ethereum Research on July 21, 2026, pushes the formal theory of cross-domain state preservation meaningfully forward — and the implications stretch well beyond academic verification. The work mechanizes the composition of preservation maps between synchronization domains and stratifies them by coupling breadth, using Isabelle/HOL as the proof engine. What comes out the other end is not just a collection of theorems but a reusable, sorry-free verification basis that any bridge, rollup exit, shared sequencer, or permissioned settlement leg can directly discharge.

Key takeaways

• Preservation maps between state machines form a full category — identity, composition, and associativity are all machine-checked in Isabelle/HOL.
• The regulatory state machine runs over five states, seven actions, and twelve valid transitions, encoding legal action semantics directly into the transition relation.
• Synchronization strength is modeled as a tower of functors graded by chain breadth; forgetting the topmost chain holdings is proved to be a natural transformation.
• The mechanization is released as a sorry-free Isabelle/HOL build and is publicly available.

Mechanized Composition of Preservation Maps and Category Structure

The central formal result is straightforward to state and hard to overestimate in significance: preservation maps between state machines form a category. Three theorems — preservation_id, preservation_compose, and preservation_assoc — give these maps identity, closed composition, and associativity respectively, all verified through generic Isabelle/HOL locales over arbitrary state machines.

Why does category structure matter here? Because it licenses link-at-a-time reasoning across arbitrarily long chains of interoperating systems. In a sequence involving a rollup leg, a base layer, and a permissioned settlement leg, the end-to-end preservation map follows from the individual links without requiring a new proof. Associativity means the grouping of hops is irrelevant to the guarantee. When an end-to-end property fails, at least one per-link obligation must have failed — the decomposition organizes the diagnosis, even if it does not perform it automatically.

The mechanization is built as a set of generic locales, meaning the laws are directly reusable by any domain that discharges the locale obligations. That design choice separates the formal framework from any specific protocol, making the basis portable across the rollup ecosystem.

Modeling Regulatory State Transitions with a Five-State Machine

Regulatory transitions are not abstract labels in this model. The mechanized instance runs over a five-state, seven-action space with twelve valid transitions out of a syntactically possible thirty-five action pairs — and that sparsity is the point. A seizure applied to an asset already in a confiscated state is legally meaningless; the model rejects it at the transition relation rather than leaving the constraint to runtime convention.

Legal semantics reflected in transition constraints

Escalation is directional, one state is terminal (formalized as confiscated_terminal), and preservation is treated as a heterogeneous-action locale interpretation. Preservation then carries concrete legal weight: the effect a regulatory transition produces must survive the passage between domains. A frozen asset cannot arrive on the receiving side merely restricted.

The mechanization is deliberately scoped. A draft Standards Track proposal, ERC-8319, currently under review on Ethereum Research, provides the public taxonomy of legally distinct actions that motivated this particular instance — but the mechanization does not implement ERC-8319, and ERC-8319 mandates no specific state machine. The two layers are intentionally separate.

Synchronization Degrees as a Tower of Functors Graded by Chain Breadth

Not every asset in a cross-domain system requires the same synchronization strength, and the functor tower formalizes that heterogeneity. The state space is graded by chain breadth: for each level k, a carrier holds all global states whose asset holdings are supported on chains 0 through k, anchored at hub chain 0. This gives one functor per level, and the index formalizes what the model calls coupling breadth.

Natural transformation theorem on forgetting topmost chain holdings

Between adjacent levels, the map degree_forget drops the holdings of the topmost chain. The central theorem — degree_natural_transformation — proves this map is natural: forgetting the topmost chain holdings commutes with every regulatory transition. Composites of these projection maps are again natural, so projection to any lower level is lawful in one step or across many.

A concrete trace illustrates what this means. Take an asset on chains 0 through 2 and a freeze indexed to it. Applying the freeze at breadth 2 and then forgetting chain 2 lands in the same state as forgetting chain 2 first and then applying the freeze at breadth 1. Projection to a narrower context cannot produce a regulatory history that contradicts the one the narrower context should have observed. The work explicitly notes that a live exit protocol with delays, retries, and membership changes is a candidate application of this law — and only that; no specific protocol is claimed to refine the model.

Model Assumptions, Assets’ Declared Degrees, and Available Artifacts

Single hub chain anchoring and implications for multi-hub scenarios

The naturality results rest on a single-hub topology: hub chain 0 is never forgotten at any level, and admissibility anchors to it throughout. Nothing in the present framework speaks to multi-hub configurations or changing coupling topologies. That boundary is not a minor caveat — it is a structural constraint on where the current theorems apply.

Assets carry fixed synchronization degrees at issuance, with dynamic changes open

The model handles static reassignment of degrees between synchronization cycles, but degree changes during a live cycle remain explicitly outside the model. The theorems are agnostic about when a degree is declared; the product design reading — declaration at issuance — is one instantiation, not a theorem statement. What happens when an asset’s degree changes while a synchronization cycle is in flight, and which degree governs that cycle, is an open question the authors flag directly.

Open Questions and Limitations in Cross-Domain State Preservation

The authors are candid about where the framework stops. Four open questions are stated explicitly, and they are not peripheral — each represents a gap that limits the current model’s scope in practically important ways.

• Aggregate degree rules: Where units with distinct declared degrees share one asset identifier, which conservative aggregation rules are sound, and at what cost to fungibility and expressiveness? The mechanization proves no multi-asset join rule.
• Dynamic promotion: If a declared degree changes while a synchronization cycle is in flight, which degree governs that cycle and where must the transition boundary be placed?
• Multi-hub naturality: The present result preserves hub chain 0. What additional structure would recover naturality across multiple hubs or a changing coupling topology?
• Obligation boundaries: Which laws belong in a public specification, which should be discharged by implementation-level conformance, and which remain design guidance?

The fungibility issue deserves particular attention. The functor tower requires no per-lot provenance — naturality squares index transitions by regulatory action, asset identifier, and chain breadth, tracking nothing about which units came from where. But it does presuppose a stable asset-level identifier with a well-defined degree assignment. Commingling units of different declared degrees under one identifier falls outside the model’s typing boundary. Two repairs are visible — bucketed identifiers or a conservative aggregate degree that dominates all unit declarations — but both carry costs: bucketed identifiers fracture fungibility until buckets retire, while a single aggregate degree widens obligations for an entire balance based on its highest-degree component.

What the work ultimately contributes is a formally verified skeleton on which operational protocol hierarchies can be placed — once the refinement from chain breadth to operational degree semantics is established. That refinement is not yet done. The skeleton is sound; building on it now requires knowing exactly where its floor ends.

FAQ

What is the main contribution of the mechanization presented?

It mechanizes the composition of preservation maps between state machines, proving they form a category with identity, composition, and associativity — all verified in Isabelle/HOL — and stratifies them by coupling breadth using a tower of functors.

How are regulatory state transitions modeled in the study?

They are modeled as a five-state, seven-action machine with twelve valid transitions, encoding legal action semantics directly into the transition relation so that legally meaningless operations — such as seizing an already-confiscated asset — are rejected at the model level rather than left to runtime convention.

What does the tower of functors represent in synchronization degrees?

It represents a graded structure of synchronization strength indexed by chain breadth, where forgetting the topmost chain holdings is proved to be a natural transformation that commutes with every regulatory transition — meaning projection to a narrower context cannot contradict the regulatory history that context should have seen.

What assumptions does the model make regarding network topology and asset synchronization degrees?

The model assumes a single hub chain 0 as the topological anchor; multi-hub configurations and changing topologies are outside the current results. Asset synchronization degrees are fixed at issuance and treated as static within a cycle; dynamic degree changes during live synchronization cycles remain an open problem.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.