7. BC-satisfying solution
Thesis. The only design that satisfies TG3's Blockchain Commitment is Option C: the escrow's TVL lives on Etherlink (as wrapped LZUSDC/LZUSDT). USDC/USDT bridges in at deposit/topup and out at withdrawal, refund, and release. Etherlink is the settlement layer — not a logic mirror. Per-campaign segregation and non-custodiality are preserved in Etherlink escrow state; Base is only the entry / exit point.
Target architecture
Source: diagrams/target-architecture.puml. On-chain-verified (LZ V1 Oracle+Relayer bridge, 0% token fee, wrapped LZUSDC) across four phases — fund / bridge-in, relayer-signed allocation, payout, refund / withdrawal.
How it works
- Value crosses on every value event. Deposit/topup bridges in; withdrawal, refund, and each release bridge out. Escrow state (allocations, slot bookkeeping) stays on Etherlink; only value events cross — 1:1 against one campaign's balance, with no shared pool and no VF buffer.
- Who signs. The operator signs and pays gas only on Base (no XTZ); the streamer signs nothing. The VF relayer signs every Etherlink tx (
allocate,release,refund), authorised by the operator's EIP-712 signature and bounded by the contract (can't over-allocate or cross campaigns) → non-custodial (funds flow escrow → bridge → recipient, never through VF). - Relayer = standing liveness component. Hot keys + funded gas on both chains + a stuck-message retry/queue (a release that debits Etherlink but whose bridge-out stalls must be recoverable without double-paying). Down ⇒ allocations and releases stall. It is a large part of the 5. TCO and the audit centrepiece.
- Caveats (detail in 9. Risks): the escrow holds wrapped LZUSDC — only as solvent as the bridge; and the operator never sees a transaction of their own on Etherlink (every Etherlink action is the relayer's) — mitigable via operator-keyed events / signatures or ERC-4337, not eliminable.
TVL-movement rails — Base ↔ Etherlink
Per campaign: 16 bridge crossings (5 topups + 1 withdrawal + 9 releases + 1 refund). The live OriginalTokenBridge takes 0% on the token; measured cost ~$0.01 in / ~$0.03 out per crossing → ~$0.38 / campaign (10. Appendix).
| Rail | Cost / campaign (16 crossings) | Status & key risk |
|---|---|---|
| LayerZero — Etherlink official bridge | ~$0.38 (measured) + gas | Live OriginalTokenBridge, 0% token fee, fast. Inherits LayerZero risk (post-$292M exploit; liquidity-capped pool). The rail VF uses now. |
| Etherlink canonical (Tezos L1) | ~gas only | Native rollup bridge — days-long withdrawal delay, multi-hop. Too slow for release. |
| Chainlink CCIP | ~$4–24 + gas | Lowest trust risk + migration target — but no USDC/USDT lane yet (LBTC only). Not usable until a stablecoin lane ships. |
Today stablecoin TVL bridging uses the Etherlink official LayerZero bridge (0% fee, cents/crossing); migrate to CCIP once it carries USDC/USDT. The escrow holds wrapped LZUSDC/LZUSDT (1:1 lock-and-mint, backed by the Base lock) — tangible only while the bridge is solvent (see 9. Risks).
Alternatives rejected
Each cheapens the mandatory bridging but breaks a BC guarantee — so VF bridges 1:1 per event:
- Batching — commingled VF buffer between batches → custodial drift, breaks per-campaign segregation and refund timing. ✗
- Shared payout pool — pays campaign A from B's money → client-money pool (VASP / MiCA), broken refunds. ✗
- Custom LP pool — VF becomes a market-maker holding client + own funds → solvency / capital / regulatory surface. ✗
The compliant design keeps per-event 1:1 TVL movement — its cost is the subject of the 6. Interactive model.