Two-way AAC bridge (CoNET ↔ Base)

Status as of 11 November 2026. This page describes the AAC bridge design the operator decided on 7 November 2026, with the deployment, limit, asset and governance rules decided on 8–10 November 2026 and the deposit confirmation and circuit-breaker rule decided on 11 November 2026. Nothing on it is deployed, and no address exists. Parts are implemented and tested locally, as marked; the fast-path anti-forgery gate has not passed. The earlier proof-driven design and its records are on AAC proof-driven cross-chain settlement. The legacy Treasury cross-chain bridge is paused.

How to read the labels

• [Implemented, pending acceptance]: implemented and tested locally. Not deployed. Acceptance, an independent audit and a separate deployment approval are still needed.
• [Approved, not yet live]: a rule the operator has decided and published. It is not deployed. Deployment still needs an independent audit and a separate approval.
• [Open]: not decided.

An operator decision is not a DAO vote.

conet-USDC on this page means the new conet-USDC contract (not yet deployed) that will replace the current one (decided, not yet live); the switch-over plan will be announced. The current contract will not be upgraded. The status of the current contract is to be verified. Support for new inflows through the previous Treasury bridge will stop (decided, not yet live).

[Approved, not yet live] AAC is a two-way USDC bridge between CoNET and Base. Seen from CoNET, Base → CoNET is a deposit and CoNET → Base is a withdrawal. Withdrawals exist from the first version; this replaces the earlier rule that version 1 has no withdrawal.

Assets and chains [Approved, not yet live]

Multi-chain same-address deployment is a design requirement and is not yet complete.

Confirmation by direction

[Approved, not yet live] Fast crediting depends on the Base sequencer's pre-confirmation. A sequencer signature proves pre-confirmation only; Ethereum L1 commitments are used to verify Base's health. If no valid L1 commitment or finality proof for Base arrives in two consecutive expected commitment windows, AAC treats the Base cross-chain path as failed and stops both directions at once (see Circuit breaker and reopening). The window and the other parameters are set by the DAO. This rule is decided; its implementation is pending. The term "early mint" describes when minting happens; it is not a stage name. Between the last valid L1 proof and the moment the circuit breaker stops the bridge there is a period of exposure; its length depends on the window parameters the DAO sets and is currently estimated at about 30 minutes, an estimate rather than a fixed limit or a service level, and any loss in that period is handled by the project case by case.

Deployment and upgrades [Approved, not yet live]

• One factory, one initialisation. A fixed AAC factory deploys the bridge contracts during initialisation: the new conet-USDC ledger, the deposit controller and withdrawal gateway, the settlement contract, the new GB and wCNET contracts, and the new treasury. Each contract's exact address is bound once to a predefined role.
• No upgrades. These contracts will be deployed at fixed addresses with no proxy and no upgrade function. This includes GB and wCNET. A later generation is a new deployment, moved to by DAO decision.
• Frozen authorisations. When initialisation completes, the key authorisations are frozen: the gateways, the controllers, the settlement contract and the source of limits. Nobody can add or replace them afterwards, and no administrator can reopen them. Releasing or clearing exposure is possible only through the bound settlement path, against a verified order.
• Route versions. A new route version may use only controller and treasury addresses that the factory bound at initialisation. A DAO route decision chooses among those bound addresses; it cannot introduce a new address.
• What is frozen is the deployed code and the key authorisation addresses. The DAO keeps the governance rules already decided: per-asset limits, asset admission, the circuit breaker and reopening.

The factory stack is [Implemented, pending acceptance] locally. Its freeze checks have not all passed, the per-stablecoin channel switch and mint and burn pause are implemented locally but not accepted, and no contract has been frozen at an address. The binding of route addresses is implemented on the governance side but is not yet wired into the factory.

No address exists yet. Addresses will be published after audit and a separate deployment approval.

Limits [Approved, not yet live]

USDC, GB and wCNET each have their own limits. Each asset has its own allowance and its own counter; there is no shared allowance between assets.

• Per transaction: 5,000 initially, for each asset. The per-asset limits are [Implemented, pending acceptance] for the USDC stack.
• Per 20-minute window: 50,000 initially, for each asset. The window is a fixed 1,200-second window, measured by the on-chain time at which CoNET accepts the order. Deposits and withdrawals of the same asset share that asset's allowance.
• Unit. USDC is counted in USDC. GB and wCNET are counted at their USDC-equivalent value, not as raw token amounts. The price source for that conversion is [Open].
• DAO adjustment. The DAO can change each asset's two limits separately: one decision may change one limit of one asset, or both limits of that asset. Other assets' limits and counters are not affected. Changes made other than by DAO decision are refused. The per-transaction and per-window limits are enforced separately.
• 50,000 USDC of outstanding exposure at most for USDC deposits (approved initial value). Exposure is tracked against Base's later Ethereum L1 commitments; a window ending does not free it.

DAO decisions [Approved, not yet live]

Every proposal, including AAC reopening and limit changes, has an observation period of 600 seconds from when voting opens. During that period votes are still collected and nothing is executed early. A DAO proposal that has reached its threshold is executed only after the 600 seconds have passed; the DAO voting window stays 7 days.

Proofs

• [Implemented, pending acceptance] Verification of real CoNET block headers and real CoNET storage proofs, which proves CoNET chain state to another chain. Tested locally; not accepted.
• [Open] Carrying a final CoNET DAO decision to an external chain with a real proof has not yet been shown to work end to end.
• Return transfers of GB and wCNET, and settlement of third-party assets, are tested only with stand-in proofs. They are not verified.
• The proof parameters are still open: format, nonce scope, finality of the source chain, expiry, who may relay, and route gating.

Fees [Approved, not yet live]

A withdrawal from CoNET to Base pays a DAO-set fee of n%, paid by the withdrawing user. It is accounted separately from the GB exchange fee. No default value is set; the fee base, currency and refund handling are [Open]. The fee mechanism is [Implemented, pending acceptance].

Per-stablecoin switches [Implemented, pending acceptance]

Each official stablecoin, including conet-USDC, has a cross-chain channel switch and a mint and burn pause. Both are implemented locally in the AAC contracts and in DAO candidate 4 (not locked); they are not accepted and not deployed. They are set separately by DAO decision and apply only to that stablecoin. Closing the channel stops both directions while in-flight messages keep their original deadlines: an unexpired message is delivered at most once after reopening, and an expired one can be refunded once the destination chain is proven to have closed it without delivery, after which it can never be delivered; the pause blocks every mint and burn of that stablecoin inside CoNET L1, but not ordinary transfers. While the conet-USDC pause is on, paid GB issuance that burns conet-USDC and exchanges of GB back to conet-USDC pause too. The current conet-USDC contract will not be upgraded and does not have these switches. Details: Third-party tokens and subscriptions, Section 5.1; decision rules: DAO and the next-generation treasury, Section 6.

Circuit breaker and reopening

The trigger below is [Approved, not yet live]: decided, with implementation pending. The DAO-only reopening is [Implemented, pending acceptance].

• If no valid Ethereum L1 commitment or finality proof for Base arrives in two consecutive expected commitment windows, AAC treats the Base cross-chain path as failed and immediately stops both directions between Base and CoNET. The window and the other parameters are set by the DAO.
• While stopped, AAC accepts no new deposits or withdrawals and mints nothing. Approved refunds stay available; they do not mint or open ordinary withdrawals.
• Reopening needs a DAO vote. When the approved reopening is executed, Base must have recovered; otherwise that vote has no effect. There is no grace period. Chain recovery alone never reopens AAC.
• After reopening, AAC re-verifies existing locks and completes them automatically; users do not resubmit. A refund stays available against a proof that the order is closed and was not minted. A refund and a completion exclude each other. The same rule applies during a long stop.

Buying GB with bridged conet-USDC

conet-USDC received through AAC deposit confirmation can buy GB under the normal rule: the GB contract burns conet-USDC at the DAO-set price per GB. There is no separate burn cap. The burn does not change the original deposit order. How GB purchases and GB exits behave while AAC is stopped is [Open].

Gate before the fast path opens

[Approved, not yet live] The fast path opens only after complete verification passes and negative tests show that forged signatures, forged block headers, forged receipts and replays are rejected. Production opening and operational acceptance are recorded separately.

Status on 7 November 2026: in the local implementation the negative tests pass, the chain-ID byte order matches a public test vector, and block-header recomputation matches real Base blocks. Positive tests use test keys only; real sequencer signature samples are still missing. The gate has not passed.

Implementation status (11 November 2026)

Open items (11 November 2026)

1. The withdrawal contract, and how Base verifies a CoNET burn.
2. The price source for counting GB and wCNET at USDC-equivalent value.
3. The expected L1 commitment window and the other circuit-breaker parameters, which the DAO sets.
4. Real sequencer signature samples for positive acceptance.
5. How GB purchases and GB exits behave while AAC is stopped.
6. Which components of the earlier bridge still run; this needs a read-only on-chain check.
7. The cross-chain proof format and its parameters.
8. The withdrawal fee details.
9. The limit unit for third-party cross-chain tokens and the initial limits of newly admitted official stablecoins.

Related

• GB purchase, metering, fees and settlement
• Third-party tokens and subscriptions
• DAO and the next-generation treasury
• AAC proof-driven cross-chain settlement (earlier design)
• Decentralized cross-chain Treasury
• Core L1 assets