Cross-chain availability

Everything that defines the protocol (the desk, the Reserve, staking, the yield split) lives on one home chain. Availability on other networks is distribution: a mirror of the staked asset, designed so that everything that crosses is either locked collateral or a price computed at home.

What travels: the staked share

The canonical cross-chain asset is c-uWatt, the staked share rather than raw uWatt, because the staked share is the self-contained form of the asset. Its value already compounds the yield, so it needs no vault, no distribution mechanism, and no desk on the destination network; it is a single number that grows. Raw uWatt stays home, where the desk enforces its pricing.

The transport is conservative:

• A 1:1 lockbox. Every share that circulates on a secondary network is matched by a share locked in the protocol's lockbox on the home chain. Burning the mirror releases the original, so every unit in circulation elsewhere has a locked counterpart at home.

• A single transport in v1. One audited interoperability layer carries the messages, with per-bridge mint and burn rate limits capping how fast any transport failure could propagate. One transport trades redundancy for a single dependency to audit and operate. If it halts, bridged transfers pause while the canonical shares remain locked and safe on the home chain. Additional transports can be added by governance later.

The price mirror

Secondary-network liquidity pools need a reference price for c-uWatt. That number is composed on the home chain, the desk's capped uWatt price multiplied by the vault's share price:

$$\text{c-uWatt mark} = \min(\$1,\ C) \times \text{(uWatt per share)}$$

A keeper carries it across, and only carries it: every input to the number is computed at home. The cap on the uWatt leg matters because pricing the share off the raw collateral ratio would let the buffer, which reaches stakers only through the yield mechanism, be sold into secondary pools, and would count the same surplus twice. The mirrored mark is what the home desk would pay. Below par the cap is inactive, so impairment passes through at full weight.

The receiving oracle treats its own keeper as a potential adversary. Three independent on-chain guards bound what any single update can do (a minimum interval between updates, a cumulative deviation band around a rolling anchor, and absolute price bounds), and a dual staleness circuit breaker halts consumption if either the pushes stop or the underlying home-chain inputs age out. A compromised keeper key can therefore delay the mirror, but cannot teleport its price.