Tesseract is the open-source atomic-composability protocol for cross-chain agents and DeFi. Autonomous agents route across many L2s at once — Tesseract settles their intents all-or-nothing across Ethereum, Polygon, Arbitrum, Optimism, and Base: MEV-protected, flash-loan resistant, resolved in under thirty seconds. No bridges, no wrapped IOUs.
What is Tesseract?
Tesseract is an open-source, cross-rollup atomic-composability protocol that gives agents and DeFi all-or-nothing execution across Ethereum L2s. It is the atomic-execution layer for cross-chain intents — not a bridge. Users and agents keep native assets on each chain, and a swap group either resolves everywhere within a deadline window or refunds everywhere.
It is built on seven audit-grade Vyper contracts and a high-performance Rust relayer, with commit-reveal MEV protection and flash-loan-resistant resolution delays — without bridges, wrapped assets, or custodial intermediaries. It maps to the 2026 agent-economy narrative of atomic composability and intents: autonomous agents operate across many rollups at once and need deterministic, all-or-nothing outcomes, not fragile bridge hops. Supported at launch: Ethereum, Polygon, Arbitrum, Optimism, and Base. MIT-licensed.
The problem
Liquidity — and increasingly autonomous agents — are spread across every rollup. To act across the gap you either bridge (locking real assets in a honeypot vault and taking a wrapped IOU with depeg risk) or chain multiple hops, each with its own latency and its own way to strand you mid-flight. For an agent executing one decision across three chains, a leg that lands here and reverts there leaves a broken, half-executed position. The two dominant answers — custodial bridges and generic messaging fabrics — both bottom out on someone off-chain staying honest.
The Tesseract solution
Tesseract expresses a cross-rollup trade or agent intent as an atomic swap group bound by a shared swap_group_id. Every leg commits as a hash first (MEV bots see nothing), reveals a block later, and resolves after a 2-block delay. All legs resolve within the deadline, or all refund — a deterministic, all-or-nothing outcome an agent can rely on. Assets never leave their home chain; there is no vault to drain and no quorum to socially engineer.
Architecture
Tesseract is built deliberately small. Every feature below is enforced in code on the rollup itself — not gated by a multisig, a validator quorum, or an optimistic dispute window.
Every swap is buffered as a hash commitment first and revealed only after the next block. Searchers, sequencers, and sandwich bots see nothing useful in the mempool — your trade lands at the price you signed for, not the price someone reorganised the block for.
Express a cross-chain intent as one atomic group: a multi-leg trade across three rollups either executes everywhere or refunds everywhere. The TesseractBuffer contract enforces group atomicity at the protocol layer, so an autonomous agent gets an all-or-nothing outcome — partial fills, stranded collateral, and half-finished cross-chain routes simply cannot happen.
Agents that route capital across many L2s at once cannot afford a leg that lands on one chain and reverts on another. Tesseract gives them a single primitive — commit the group, get resolve-everywhere-or-refund-everywhere — so an agent submits one intent and settles a deterministic outcome, not a pile of independent bridge transactions each with its own failure mode.
A mandatory 2-block resolution delay (configurable up to your chain finality) makes single-block flash loan exploits structurally impossible. Combined with role-gated resolution and a circuit breaker after 50 consecutive failures, the buffer hardens the surface attackers usually target.
A high-throughput Rust relayer monitors 4+ chains in parallel over WebSocket with HTTP failover, tracks per-chain confirmation rules, and recovers stuck nonces automatically. Auto-scales 2–10 instances on CPU and persists state in PostgreSQL — not in someone's memory.
Tesseract coordinates native swaps directly on each rollup. Users hold real assets, not bridge receipts. There is no honeypot multisig, no canonical-vs-wrapped fragmentation, and no $600M failure mode waiting to be exploited.
AtomicSwapCoordinator gives makers and takers a real on-chain order book with configurable slippage tolerance and partial fill support. Settle 500 USDC of a 1000 USDC order without forcing the entire trade through.
The TESS token powers protocol governance, fee discounts up to 50%, and staking rewards from 5% to 15% APY based on lock duration. Fees flow through an on-chain FeeCollector — transparent, auditable, no opaque off-chain treasury.
How it works
Three phases, all enforced by Vyper on each rollup. The relayer submits transactions; it never authorises them.
Each leg submits keccak(payload ‖ secret) with a shared swap_group_id and a deadline. The mempool shows only opaque bytes — nothing to front-run.
One block later, the user reveals the plaintext. The contract checks the hash. Block ordering is already settled, so the reveal is safe to make public.
After the 2-block delay, every leg resolves — or, if any leg misses its deadline, every leg becomes refundable. No stuck mid-flight state.
let group = SwapGroup::new()
.leg(Chain::Arbitrum, give(usdc, 1_000))
.leg(Chain::Base, take(weth, 0.31))
.deadline(Duration::from_secs(30));
// commit-reveal is handled per leg
let receipt = relayer.submit(group).await?;
assert!(receipt.resolved_or_refunded()); @external
def buffer_transaction_with_commitment(
tx_id: bytes32,
commitment: bytes32, # keccak(payload || secret)
swap_group_id: bytes32,
deadline: uint256,
refund_to: address,
):
assert self.has_role(BUFFER_ROLE, msg.sender)
assert deadline > block.timestamp
self.commitments[tx_id] = Commit({
hash: commitment, group: swap_group_id,
reveal_block: block.number + 1,
deadline: deadline, refund_to: refund_to,
}) Illustrative snippets — see the full architecture on the how-it-works page and the canonical source in the repository.
Use cases
Give an autonomous agent one all-or-nothing primitive for acting across many rollups at once — submit a cross-chain intent, settle a deterministic outcome, never a half-executed position.
Let a trader on Base buy an asset that only has deep liquidity on Arbitrum — atomically, at the price they signed for, with no bridge in the middle.
Capture a price gap between three rollups as a single atomic operation instead of three sequential bridge legs, each with its own failure mode.
Rebalance a strategy that holds positions on several rollups without ever routing treasury assets through a bridge vault.
Settle a large cross-rollup OTC trade between two parties with no escrow agent and no wrapped-asset counterparty risk.
Honest comparisons
We don't pretend our competitors are bad. We do explain the architectural choices and what they cost you.
LayerZero is a general-purpose omnichain messaging protocol that lets contracts on chain A trigger contracts on chain B via an off-chain Oracle + Relayer pair. It's a brilliant primitive for arbitrary cross-chain calls — but the security model bottoms out at trusting that the Oracle and Relayer don't collude.
Wormhole is a generic message-passing protocol secured by 19 Guardian nodes that sign attestations of source-chain events. It moves data and assets across ~30 chains, but its security and atomicity ultimately rest on the Guardian set being honest and available.
Across is an intent-based bridge that uses competitive relayers to fill user requests on the destination chain, then settles those fills back to relayers using UMA optimistic oracle on a slower cadence. Fast UX, but the security model is optimistic, not atomic.
Optimism Interop gives OP-Stack chains low-latency, trust-minimised message passing inside the Superchain interop set. It is an excellent native interoperability layer for the Superchain — but it is scoped to that shared trust zone and models cross-chain interaction as messaging, not as atomic settlement of a whole multi-leg group.
Chainflip is a Substrate-based appchain that runs its own validator set, vaults user funds, and executes cross-chain swaps through threshold signature schemes. It supports non-EVM chains (Bitcoin, Solana) — but that comes with a separate consensus layer and an external trust boundary.
THORChain is a Cosmos-based cross-chain liquidity protocol that uses continuous liquidity pools and a TSS-secured validator set to swap native assets across Bitcoin, Ethereum, and several major chains. Production-proven, but it's a separate L1 with its own economics.
From the blog
Step-by-step technical guide to adding Tesseract atomic swaps to a DeFi yield vault that rebalances across Ethereum L2s — with code, gotchas, and operational checklist.
An honest, technical comparison of Wormhole's Guardian network and Tesseract's contract-enforced atomicity — including what happened in February 2022 and why it matters.
Where the bridge wars of 2022 actually landed, why intent-based protocols took over the conversation, and what the next 18 months look like for atomic settlement across L2s.
FAQ
Explore the docs
The full protocol documentation — architecture, token design, definitions, and the story behind Tesseract.
Every capability in depth — the MEV shield, atomic swap groups, flash-loan resistance, and the Rust relayer.
The commit → reveal → resolve lifecycle, relayer topology, and a Vyper code walkthrough.
Clone, run the 135-test suite, deploy the contracts to a testnet, and create your first swap group.
TESS utility, staking tiers, fee discounts, relayer bonding, and on-chain governance.
Plain-language definitions of atomic swap groups, commit-reveal, resolution delay, and MEV.
Project origins, the CRATE research it draws on, and the Cryptuon organisation behind it.
Clone the repo, run the 135-test suite, deploy to testnet in fifteen minutes. The protocol is open source, the contracts are audit-ready, and the documentation is honest about what's done and what isn't.