Bering Bridge

Oracle-gated Liquid Network mint covenant for an ETH→Liquid bridge. A Simplicity contract holds the reissuance token; when at least 3 of 5 oracles sign an attestation payload, a mint transaction can reissue assets on Liquid to a specified recipient. The payload binds the mint to an Ethereum transaction, recipient, and a one-time ticket UTXO (replay protection).

Built with Simplex (smplx-std).

How it works

flowchart LR
    subgraph eth [Ethereum]
        EthTx[Eth transaction]
    end

    subgraph oracles [Oracle set 3-of-5]
        OracleSign[Oracle signatures]
    end

    subgraph liquid [Liquid testnet]
        Covenant[Covenant UTXO]
        Ticket[Ticket UTXO]
        Recipient[Recipient]
    end

    EthTx --> OracleSign
    OracleSign --> MintTx[Mint transaction]
    Covenant --> MintTx
    Ticket --> MintTx
    MintTx --> Recipient
    MintTx --> Covenant

Oracle payload (SHA-256 over concatenated fields):

sha256(domain | asset_id | asset_amount | recipient_script_hash | eth_txid | ticket_txid | ticket_vout)

The on-chain contract is simf/oracle_asset_release.simf. Rust code wraps it for deployment, testing, and browser mint PSET building.

Repository layout

bering-bridge-liquid/
├── simf/                              # Simplicity contract source
├── src/
│   ├── artifacts/                     # generated by `simplex build` (gitignored)
│   ├── oracle_asset_release.rs
│   ├── bering_bridge_protocol_wasm.rs
│   ├── bering_bridge_burn_wasm.rs
│   ├── covenant_token_discovery_wasm.rs
│   └── bin/oracle_asset_release_address.rs
├── tests/
├── scripts/
│   ├── build-basic-wasm-package
│   └── prepare-basic-wasm-package.mjs
├── pkg/                               # generated npm package (gitignored)
├── Cargo.toml
└── Simplex.toml

Prerequisites

| Tool | Purpose | |------|---------| | Simplex / simplexup | simplex build, simplex test | | Rust 1.91.0 | matches rust-version in Cargo.toml | | Sibling ../smplx repo | path dependency in Cargo.toml | | wasm-pack | build the browser npm package | | wasm32-unknown-unknown target | rustup target add wasm32-unknown-unknown | | LLVM/clang (macOS) | compile secp256k1 for WASM; see build script below |

Build

Generate Simplicity artifacts from the .simf sources (required before compile or test):

simplex build

This creates src/artifacts/ with typed Rust bindings for the contract.

Run regtest

simplex regtest

Populate Simplex.toml with regtest config

cp Simplex.example.toml Simplex.toml

Fill in the RPC URL, username, and password from the simplex regtest output.

Verify with tests

Run the Rust unit tests for the WASM helpers, including find_current_covenant_token_utxo:

cargo test --lib covenant_token_discovery_wasm

Local regtest end-to-end mint flow:

simplex test oracle_asset_release_test --nocapture

Testnet deposit address smoke test:

simplex test --target oracle_asset_release_external_oracles_test \
  external_oracle_testnet_deposit_address_is_derivable \
  --nocapture

Generate covenant deposit address

Address tooling targets Liquid testnet. Production oracle pubkeys and the protocol SLIP77 master blinding key are defined in src/oracle_asset_release.rs.

Print the confidential covenant deposit address and related script metadata:

cargo run --bin oracle_asset_release_address

Capture these fields from the output:

• protocol_covenant_slip77_master_blinding_key
• deposit_address
• blinding_pubkey
• script_pubkey
• script_hash

For the current oracle keys and blinding key, the expected testnet deposit address is:

tlq1pqfpqlc2xzs09tfpwxx4mvd3a63kcc5hxyzyjf9qvuzlxx5euj6a9vxe34zwjzfrush26qj82w5kumszfx8wuutq4jq2n49kjdd7ucn8axyxfz0h0px7j

Optional overrides:

cargo run --bin oracle_asset_release_address -- \
  --slip77-master-blinding-key <hex>

cargo run --bin oracle_asset_release_address -- \
  --blinding-pubkey <compressed_pubkey_hex>

Build the WASM npm package

From the repo root:

./scripts/build-basic-wasm-package

This runs:

1. wasm-pack build --release --target web — compiles the crate WASM exports into pkg/
2. scripts/prepare-basic-wasm-package.mjs — sets npm metadata, copies LICENSE and this README into pkg/

On macOS, if the default clang cannot target WASM:

CC_wasm32_unknown_unknown=/opt/homebrew/opt/llvm/bin/clang ./scripts/build-basic-wasm-package

The build script auto-detects Homebrew LLVM when CC_wasm32_unknown_unknown is unset.

JavaScript API

Install the package locally from ./pkg or from npm as bering-bridge. Published artifact files use the same hyphenated basename (for example bering-bridge.js and bering-bridge_bg.wasm). In Rust code, Cargo exposes the crate as bering_bridge::.

import init, {
  build_bering_bridge_mint_pset,
  build_bering_bridge_burn_pset,
  find_current_covenant_token_utxo,
} from "bering-bridge";

await init();
const response = JSON.parse(build_bering_bridge_mint_pset(JSON.stringify(request)));

build_bering_bridge_mint_pset accepts a JSON string matching BeringBridgeMintPsetRequest in src/bering_bridge_protocol_wasm.rs and returns a JSON string with the mint PSET and payload metadata.

Burn PSET construction uses build_bering_bridge_burn_pset(JSON.stringify(request)). The request supplies network, asset_id, asset_amount, evm_recipient, wallet UTXOs as { outpoint, tx_hex, secrets? }, fee_asset, change_address, and fee_rate. The transaction contains output 0 as the asset burn OP_RETURN and output 1 as bridge metadata OP_RETURN with 0x02 || evm_recipient_20_bytes.

Covenant token discovery uses find_current_covenant_token_utxo(JSON.stringify(request)) with a covenant deposit address, SLIP77 master blinding key, expected reissuance token id, and candidate { txid, vout, tx_hex } entries. It returns the matching txid:vout and unblinded token details for the current amount-1 reissuance token UTXO.

Publish to npm

1. Bump version in Cargo.toml (the prepare script syncs it to pkg/package.json).

2. Build the package:

   ./scripts/build-basic-wasm-package

3. Inspect the tarball contents:

   npm pack --dry-run ./pkg

4. Log in and publish:

   npm login
   npm publish ./pkg --access public

Published package name: bering-bridge.

Override the npm name for experiments:

BERING_BRIDGE_NPM_PACKAGE=my-fork-name ./scripts/build-basic-wasm-package

Key roles

| Key | Role | |-----|------| | Issuer key | Funds the initial issuance; not needed after the reissuance token is locked in the covenant | | Protocol SLIP77 master blinding key | Derives the covenant blinding key; required to unblind the covenant UTXO when building mint transactions | | Oracle keys | Sign the attestation payload only; do not sign the Liquid transaction |

License

MIT — see LICENSE.