Burn-and-Mint Bridges Explained

• Burn-and-mint bridges are cryptoeconomic protocols transferring assets across blockchains by burning tokens on the source chain and minting equivalents on the destination.
• ASAS-BridgeAMM couples a burn-and-mint bridge with an automated market maker using a trinary state machine to dynamically adjust risk parameters based on latency and market conditions.
• Empirical evaluations show that dynamic risk pricing reduces insolvency risk by 73% and maintains liquidity provider engagement even during volatile market events.

Burn-and-mint bridges are cryptoeconomic protocols enabling asset transfer between distinct blockchains by destroying (burning or locking) tokens on the source chain and minting synthetic equivalents on the destination. The systemic risk posed by such systems derives from their cross-chain consensus dependencies, operational latency, adversarial frontiers, and discrete failure modes. ASAS-BridgeAMM, as exemplified in "ASAS-BridgeAMM: Trust-Minimized Cross-Chain Bridge AMM with Failure Containment" (You et al., 18 Jan 2026), advances this lineage by coupling a burn-and-mint bridge to an automated market maker (AMM) with a formally specified mechanism for graceful degradation, quantifying bridge-induced risk and dynamically pricing it within the protocol.

1. Formal State Machine and Contained Degradation

ASAS-BridgeAMM models bridge operation as an atomic state machine $\mathcal{M} = (S, \Sigma, \delta, s_0)$ with three states:

• $S_N$: Normal
• $S_R$: Restricted (Contained Degradation)
• $S_H$: Halted

Transitions are determined by cross-chain latency $\tau$, health index $\mathcal{H}$, and oracle price deviation $\delta$. The start state $s_0$ is $S_N$, and the transition function $\delta: S \times \Sigma \to S$ enforces state change based on quantifiable risk parameters. Transition guards such as $S_N$0 or $S_N$1 trigger $S_N$2, while $S_N$3, $S_N$4, or excessive oracle deviation lead to $S_N$5. Recovery to $S_N$6 requires all risk metrics returning within thresholds. This trinary model contrasts with legacy bridge architectures that admit only "operational" vs. "compromised" states, introducing the possibility of limited, risk-priced outflows under stress rather than total halt or unbounded capital extraction (You et al., 18 Jan 2026).

2. Latency as Quantifiable Execution Risk

ASAS-BridgeAMM elevates observed cross-chain message latency, $S_N$7, as a first-class risk metric. Under non-adversarial conditions, $S_N$8 empirically. This latency directly informs protocol parameters:

• Dynamic Haircut $S_N$9: Funds transferred are subject to a haircut increasing with latency:

$S_R$0

With $S_R$1, $S_R$2, $S_R$3 min, $S_R$4 h.

• Slippage Bound $S_R$5: Enforced per state—$S_R$6 in $S_R$7, doubled in $S_R$8, infinite (all swaps revert) in $S_R$9.
• Withdrawal Limit $S_H$0: Caps maximum withdrawal per epoch by state—up to $S_H$1 of pool in $S_H$2, $S_H$3 in $S_H$4, $S_H$5 in $S_H$6.

This explicit risk-pricing approach throttles user flows in proportion to growing uncertainty, mitigating contagion from bridge liveness/finality delays.

3. Automated Market Maker (AMM) Coupling and Price Invariant

The bridging process consists of users locking assets on the source chain via IngressVault.sol; cross-chain messages communicate lock events via a relayer/oracle "Hub", culminating in synthetic asset minting on the destination chain within BridgeAMM.sol. The on-chain AMM uses a risk-adjusted constant-product invariant:

$S_H$7

where $S_H$8 represent pool reserves. The dynamic haircut $S_H$9 reduces effective liquidity during latency-induced uncertainty, increasing slippage and price impact. During $\tau$0 standard Uniswap-style execution applies; in $\tau$1 haircuts and slippage caps adjust upward and withdrawal caps tighten; in $\tau$2 swaps revert and withdrawals are locked via CircuitBreaker.sol.

4. Safety, Bounded Bad Debt, and Liveness

Safety is established in the presence of a Byzantine Relayer adversary (permitting delays, reordering, censorship, and front-running but not signature forgery):

• Theorem 1 (Bounded Bad Debt):

$\tau$3

Proof sketch: each swap contracts the AMM invariant by at most $\tau$4, and with per-epoch withdrawal throttling, cumulative loss per epoch is capped. The circuit breaker precludes subsequent loss epochs.

• Liveness (Theorem 2): If $\tau$5, oracle deviations $\tau$6, and oracle integrity holds, then honest swaps eventually finalize since the protocol remains in $\tau$7 or $\tau$8, both of which allow settlement.

These properties are formally proven, ensuring bounded insolvency and settlement completion with high confidence, even under adversarial delay or natural market volatility.

5. Manipulation Resistance and Adversarial Robustness

Let $\tau$9 be attack size, $\mathcal{H}$0 the oracle distortion, and $\mathcal{H}$1 the induced delay. Adversarial profit function:

$\mathcal{H}$2

Whenever $\mathcal{H}$3 or $\mathcal{H}$4, the circuit breaker nullifies profit $\mathcal{H}$5 by halting swaps. Monte Carlo simulation (100,000 runs) demonstrates $\mathcal{H}$6 per-epoch bad debt of 0.189% ($\mathcal{H}$7), and solvency probability $\mathcal{H}$8 over stress regimes (0–50% price crash, up to 60 min latency, (You et al., 18 Jan 2026)).

6. Empirical Evaluation and Practical Results

Two primary evaluation tracks were used:

• Historical Replay (18 months, Ethereum + 2 auxiliary chains): 54,700 bridge swaps under observed network and price variability, including high-volatility events. Found worst-case bridge-induced insolvency reduced by 73% relative to baseline lock-and-mint models and transaction volume retention of 104.5% (liquidity providers remained during stress).
• Monte Carlo Stress Testing: System maintained $\mathcal{H}$9 under diverse adversarial and market scenarios, including up to 50% asset price drawdown and 30 min cross-chain latency.

Metrics, replay methodology, and code-level instrumentation adhere precisely to the stated protocol and analysis criteria.

7. Core Contract Modules

Key modules are implemented in Solidity-style pseudocode:

• IngressVault.sol: Manages collateral lock on source chain.
• Hub.sol: Aggregates latency attestations and oracle pricing.
• BridgeAMM.sol: Implements AMM, state machine, and risk adaptation.
• CircuitBreaker.sol: Automates pausing and reinitialization during critical events.

A summary of implementation details is provided below:

Module	Role	Key Interface
IngressVault.sol	Source chain deposit and lock tracking	lock(address asset, uint256 amt)
Hub.sol	Cross-chain latency and price aggregation	attestLatency(uint256 t_src), aggregatePrice(...)
BridgeAMM.sol	Stateful AMM, enforces slippage, haircuts, limits	swap(uint256 dx), checkState(...)
CircuitBreaker.sol	Protocol halt and recovery	trigger(), reset()

Contained degradation is enforced at the contract layer via mode checks and dynamic parameterization, directly implementing the state machine and risk response logic in executable code.

---

ASAS-BridgeAMM transforms burn-and-mint bridges from brittle, binary-fail systems into "safe-to-fail" cryptonetworks by embedding dynamic risk-based controls at the protocol level. This architecture formally bounds bad debt, preserves user settlement under adverse conditions, and empirically demonstrates enhanced insolvency resistance and capital efficiency, as established through both simulation and historical chain replay (You et al., 18 Jan 2026).