# Tesseract — Full Technical Brief

## What it is

Tesseract is an open-source, production-ready cross-rollup atomic swap protocol for Ethereum L2s. It enables trustless multi-leg token swaps across Ethereum, Polygon, Arbitrum, Optimism, and Base without bridges, wrapped assets, or third-party custody. The protocol is built around three components:

1. **Seven Vyper smart contracts** deployed on each supported rollup.
2. **A Rust relayer** that monitors chain events and submits coordination transactions.
3. **A TESS governance/utility token** for staking, fee discounts, and on-chain governance.

License: MIT. Organisation: Cryptuon. Repository: https://github.com/cryptuon/tesseract. Homepage: https://tesseract.cryptuon.com

## Why it exists

Existing cross-chain infrastructure falls into two buckets:

- **Bridges with custodial assumptions** (Wormhole, Multichain, traditional canonical bridges) — they lock assets in a vault and mint wrapped IOUs. The vault is a honeypot; multiple multi-hundred-million-dollar exploits have followed.
- **Generic messaging fabrics** (LayerZero, Axelar, Hyperlane) — they pass arbitrary messages cross-chain via off-chain oracles/relayers. Their atomicity and security properties depend on those off-chain components being honest and live.

Neither is a great fit for the specific problem of "I want to swap token X on chain A for token Y on chain B, atomically, without anyone able to front-run me." That's the problem Tesseract was built for.

## Core security model

### Commit-reveal MEV protection

Every Tesseract swap is a three-phase process:

1. **Commit**: User submits `keccak(payload || secret)` to TesseractBuffer along with a tx ID, deadline, swap group ID, and refund recipient. The payload is hidden.
2. **Reveal**: Once the commitment is included on-chain (one block later), the user submits the plaintext payload + secret. The contract verifies `keccak(payload || secret) == commitment`.
3. **Resolve**: After a configurable minimum delay (default 2 blocks), an authorised resolver triggers final execution.

This shape defeats the entire mempool-MEV stack: searchers see opaque commitment bytes, and by the time the payload is revealed the block ordering that would have enabled a sandwich is already settled.

### Flash-loan resistance

The minimum resolution delay (`MIN_RESOLUTION_DELAY`) is a parameter, defaulting to 2 blocks. Even a perfectly atomic flash loan cannot span two blocks, so flash-loan-funded attacks on buffered state are structurally impossible — not "mitigated", impossible.

### Atomic swap groups

Multi-leg swaps are bound by a shared `swap_group_id`. All legs in the group must reach resolution before any single leg's funds release. If any leg expires past its deadline, all legs in the group become refundable.

This is the key primitive that distinguishes Tesseract from per-hop bridges: a 3-way swap (ETH → USDC → MATIC → ETH across three rollups) is one atomic operation, not three sequential operations with three separate failure modes.

### Role-based access control

Three contract roles:
- `BUFFER_ROLE`: can submit buffered transactions.
- `RESOLVE_ROLE`: can trigger final resolution after the delay.
- `ADMIN_ROLE`: can pause, set parameters, manage roles.

Plus an `emergency_admin` who can trigger an immediate pause. A circuit breaker auto-triggers after 50 consecutive failed resolutions to halt the protocol while operators investigate.

## Contract architecture

Seven Vyper contracts on each chain:

| Contract | Approx. size | Purpose |
|----------|-------------|---------|
| `TesseractBuffer.vy` | 12,578 bytes | Core transaction buffering, commit-reveal, swap groups, refunds |
| `AtomicSwapCoordinator.vy` | 8,332 bytes | Order book, slippage protection, partial fills |
| `TesseractToken.vy` | 4,521 bytes | TESS ERC-20 governance token |
| `TesseractStaking.vy` | 6,890 bytes | Staking with tiered APY (5–15%) and fee discounts |
| `FeeCollector.vy` | 3,245 bytes | Protocol fee collection and distribution |
| `RelayerRegistry.vy` | 4,112 bytes | Relayer bonding, registration, slashing |
| `TesseractGovernor.vy` | 5,678 bytes | On-chain governance, proposals, voting |

Vyper was chosen specifically because it has built-in overflow protection, no inheritance, no inline assembly, and a small surface area — properties that materially shrink the audit cost of a protocol that holds buffered swap state.

## Relayer architecture

The Rust relayer is the only off-chain component, and it has no privileged authority: it can submit transactions but cannot authorise resolution beyond what the contracts permit.

Key features:
- Multi-chain monitoring over WebSocket with HTTP failover.
- Chain-specific finality tracking (different rollups have different confirmation rules).
- Nonce gap handling and stuck-transaction recovery.
- PostgreSQL state persistence.
- Prometheus metrics + Grafana dashboards.
- Auto-scaling 2–10 ECS tasks based on CPU utilisation.

Performance targets:
- <30 seconds for cross-chain coordination end-to-end.
- 100+ tx/min per relayer instance.
- 99.9% uptime with multi-instance redundancy.

## Tokenomics

The TESS token has three roles:
1. **Governance** — TesseractGovernor uses TESS-weighted voting for protocol upgrades and parameter changes.
2. **Fee discounts** — stakers receive up to 50% discount on swap fees.
3. **Relayer bonding** — relayers must stake TESS in RelayerRegistry to be eligible to coordinate.

Staking APY ranges from 5% (short locks) to 15% (long locks). Rewards come from the FeeCollector — protocol fees collected on swaps flow to stakers, not to a foundation treasury.

## Gas profile

| Operation | Approx. gas | Notes |
|-----------|------------|-------|
| `buffer_transaction` | ~120,000 | Basic buffering, no commit-reveal |
| `buffer_transaction_with_commitment` | ~150,000 | Full commit-reveal flow |
| `reveal_transaction` | ~80,000 | Reveal phase |
| `resolve_dependency` | ~100,000 | Final resolution |
| `create_swap_order` | ~180,000 | Order book entry |
| `fill_swap_order` | ~200,000 | Taker fill (full or partial) |

A typical 2-leg atomic swap therefore costs roughly 350,000 gas per chain — well within L2 economics.

## Test suite

135 tests in the open-source repo, broken down:

| Category | Tests |
|----------|-------|
| Contract compilation | 11 |
| Tokenomics (token, staking, governance) | 21 |
| Access control (roles, permissions) | 27 |
| Safety (emergency, circuit breaker) | 26 |
| Cross-chain integration scenarios | 23 |
| Other | 27 |

Result on `main`: 86 passed, 40 xfailed (known limitations), 9 xpassed (unexpected pass).

## Use cases

**Cross-chain DeFi**
- Atomic arbitrage across Ethereum, Polygon, and Arbitrum without bridge risk.
- Multi-chain liquidity rebalancing for AMMs and lending markets.
- Cross-rollup collateral and borrow coordination.
- Multi-chain governance execution.

**Enterprise multi-chain**
- Supply-chain state synchronisation across permissioned rollups.
- Identity reconciliation across enterprise L2s.
- Payment-rail settlement across different networks.

**Protocol infrastructure**
- Trust-minimised bridge alternatives.
- Cross-chain oracle reconciliation.
- Multi-rollup DAO governance.

## Comparison to alternatives

### Tesseract vs LayerZero
LayerZero is a generic omnichain messaging fabric secured by an Oracle + Relayer pair. Tesseract is a purpose-built atomic swap protocol with on-chain commit-reveal and group atomicity. LayerZero's atomicity depends on off-chain honesty; Tesseract's is enforced by Vyper contracts.

### Tesseract vs Wormhole
Wormhole is a 19-validator Guardian network that signs cross-chain attestations and mints wrapped assets. Tesseract has no Guardian set, no wrapped assets, and no bridge vault — the attack surface that drained Wormhole for $325M in February 2022 does not exist in Tesseract.

### Tesseract vs Across Protocol
Across is an intent-based bridge using competitive relayers with UMA optimistic settlement. Tesseract resolves atomically on-chain with no optimistic dispute window. Across is a one-way fast bridge; Tesseract is a multi-leg atomic swap.

### Tesseract vs Chainflip
Chainflip is a Substrate appchain with its own validator set and TSS-controlled vaults. Tesseract runs entirely on existing L2s and inherits each L2's security; there's no separate consensus layer to trust.

### Tesseract vs THORChain
THORChain is a Cosmos chain with continuous liquidity pools and a TSS validator quorum, focused on Bitcoin and major L1s. Tesseract uses each rollup's native DEX liquidity and focuses on EVM L2s — smaller scope, smaller attack surface, complementary rather than competing.

## Pricing model

Tesseract is open source under MIT. The protocol itself is permissionless and free to use; users pay only swap fees (a portion of which routes to stakers and a portion to the relayer that coordinated the swap).

For integrators (DEXes, wallets, custodians, enterprise teams), Cryptuon offers a paid custom engagement tier covering integration support, audit liaison, dedicated relayer infrastructure, and SLAs.

## Frequently asked questions

**Q: How is this different from a bridge?**
A: A bridge locks the original asset and mints a wrapped copy on the destination chain. Tesseract never moves assets across chains — it coordinates simultaneous, atomic swaps already happening on each chain. There is no lock contract and no wrapped IOU.

**Q: What stops MEV on the destination chain?**
A: The commit-reveal scheme hides the swap payload until after the commitment is on-chain. A searcher reading the mempool sees only the hash. By the time the reveal lands, block ordering is already settled.

**Q: What chains are supported?**
A: Ethereum, Polygon, Arbitrum, Optimism, Base — mainnets and testnets. Adding a new EVM rollup is a deploy-the-contracts-and-point-a-relayer-at-it operation.

**Q: Do I need to run a relayer?**
A: No. End users only interact with the Vyper contracts. Relayers are infrastructure operators who bond TESS and earn fees for coordinating cross-chain resolution.

**Q: What if a leg of a multi-chain swap fails?**
A: The swap group either resolves everywhere within the deadline window (5–300 seconds, configurable) or refunds everywhere. There's no stuck-mid-flight failure mode.

**Q: Is it audited?**
A: 135 in-house tests pass; a third-party security audit is in progress before mainnet launch.

**Q: Why Vyper?**
A: Built-in overflow protection, no inheritance, no inline assembly, small surface area — properties that shrink audit cost for a protocol that holds buffered cross-chain state.

## Contact

- GitHub Issues: https://github.com/cryptuon/tesseract/issues
- GitHub Discussions: https://github.com/cryptuon/tesseract/discussions
- Discord: https://discord.gg/tesseract
- Twitter: https://twitter.com/tesseractprotocol