Validator payouts happen off-chain by joining the
submitter_pubkey
field on DepositAttestationFinalized / RedemptionAttestationFinalized
events against the aggregator-side validator roster, and disbursing
from the swept treasury. The bridge does not run pro-rata distribution
on-chain.
Each program is independently upgradeable by the admin multisig, subject to
the protocol-config timelock.
Burn lifecycle: escrow, then burn
Burning wPRL is a two-instruction state machine rather than a single “burn now, redeem later” call:request_withdrawal— the user’s wPRL transfers into a program-owned pending withdrawal vault (a shared ATA). It is not burned yet. The Token-2022 transfer fee is waived for this internal escrow move (harvested back to the vault in the same transaction). The request also names the Cold Reserve UTXO the redemption will spend: the same transaction opens a per-outpointColdReserveUtxoClaimPDA, which atomically enforces that no two open requests can bind the same UTXO.complete_redemption— after Pearl has confirmed the redemption transaction and validators have attested to it, the escrowed wPRL is burned from the vault (signed by the vault-owner PDA), the request and claim PDAs are closed, and fees are deposited.
cancel_expired_withdrawal transfers the
escrowed wPRL back to the user from the vault and closes the claim PDA. No re-mint is required — and so nacre_two_way_peg does not hold
unconditional mint authority for the cancel path. The mint authority is
only exercised by mint_deposit.
Two invariants drop out of this design:
wPRL_supply ≤ PRL_backing— tokens are burned only after Pearl has confirmed the corresponding PRL has already left the Cold Reserve. The bound is an inequality because escrowed wPRL (for in-flight withdrawals) sits between the user’s burn intent and the Pearl payout: those tokens are out of user hands but still part of the on-chain supply until the redemption confirms.- A Cold Reserve UTXO can be bound to at most one open withdrawal at a time — enforced atomically by PDA uniqueness.