Supply-integrity simulation
The Liquid peg-out drain, made runnable. A drain need not bypass a gate: an issuance bug mints valid-but-unbacked units, and a correct peg-out honors them — the gate was fine; the count was contaminated. The defense is a conservation invariant (minted == locked) wired to an automatic halt, not an alert.
Locked on source (reserve / backing)
0
Minted on dest (supply)
0
Supply invariant: minted == locked ✓ holds
| Question | Answered by | Status |
|---|---|---|
| Authorization — is this a valid unit? | the peg-out gate | ✓ always yes |
| Supply integrity — minted under the invariant? | the issuance path | ✓ backed |
Try ①②④ (skip ③): the gate honors the poisoned units and the reserve drains below zero. Then Reset and try ①②③④: step ③ halts the bridge and ④ is blocked. Same gate — the difference is the invariant.
Event log
00 Fresh bridge — reserve 0, supply 0. Invariant holds.
Why a halt, not an alert — a good invariant has three properties
- Independently computable — from source reserve + dest supply, not the system's own bookkeeping (or it re-reads the same lie).
- Violation-is-meaningless — if
minted ≠ locked, every downstream number is void; there is no "degraded mode" to limp on. - Wired to an automatic halt — an alert asks a human to notice, and not-noticing is the whole failure. Step ③ engages the halt here.
Design: rabbit/docs/features/jayverse-token-bridge.md §6 and the liquid-issuance-not-authorization PoC. Checking the actor is not the same as checking the object.