> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pfbridge.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Mainnet

> Stellar + Ethereum mainnet, admin and arbiter handed off to multisigs, 24h timelock, protocol fee mechanism, USDC ↔ USDC launch route, reconciliation listener.

<Note>
  🔨 **Planned for T3.** Audit-gated mainnet deployment of the full
  T1 + T2 contract suite, plus mainnet-only operational primitives
  (timelock, fees, multisig handoffs).
</Note>

Phase 4 is the launched mainnet architecture. The bulk of the
contract work is already in Phases 1–3; Phase 4 hardens the
operational surface so the protocol can hold real value.

## Architecture diagram

<img src="https://mintcdn.com/proofbridge/1ew08pldeeuBKd_p/architecture/_diagrams/phase-4-mainnet.png?fit=max&auto=format&n=1ew08pldeeuBKd_p&q=85&s=a596e86ad8b673a41508497c02d3a0a1" alt="Phase 4 architecture — Mainnet end-state" width="1800" height="658" data-path="architecture/_diagrams/phase-4-mainnet.png" />

## Delta from Phase 3

What changes vs [Phase 3](/architecture/phase-3-agents-disputes):

<CardGroup cols={2}>
  <Card title="Multisig admin + Timelock" icon="users">
    Single-key admin replaced by an Admin Multisig on each chain
    (Stellar account-level multi-sig, Gnosis Safe on EVM). Admin
    operations flow through a new Timelock module with a 24-hour delay.
    Pause / unpause exempt for emergency response.
  </Card>

  <Card title="Arbiter Multisig" icon="scale-balanced">
    `ArbiterRole` moves from "= admin" to its own dedicated 5-of-7
    multisig (3 team + 4 ecosystem). Quorum of 5 from a 3+4 pool
    guarantees ≥ 2 non-team signers in any decision by construction.
    Ecosystem signers are sourced via the Stellar Foundation.
  </Card>

  <Card title="Protocol fee on `unlock`" icon="coins">
    `protocol_fee_bps = 20` (0.2%) and `lp_fee_bps = 30` (0.3%), capped
    at 100 bps each. Bridger nets 99.5% of the destination amount;
    0.3% stays in the maker's `ad.balance` as LP profit; 0.2% routes
    to the new Fee Pool.
  </Card>

  <Card title="Per-route bond config" icon="sliders">
    `BondConfig { bond_token, min_bond, bond_bps }` per route. USDC
    route launches with bond in USDC, floor of 1 USDC, ratio of 50 bps
    (0.5%). Same-token denomination keeps the math unit-clean without
    an oracle.
  </Card>

  <Card title="Reconciliation listener" icon="binoculars">
    Off-chain HA service, two-region. Watches both chains via private
    RPC providers, detects settlement discrepancies within a 5-minute
    SLA, alerts on-call. Read-only — no contract authority.
  </Card>

  <Card title="Bootstrap mode" icon="bolt">
    Initial deploy runs without delay so the admin can wire routes,
    fees, and roles. `activate_timelock()` is a one-shot irreversible
    flag flip before multisig handoff.
  </Card>
</CardGroup>

## Fee math

The fee mirrors the protocol's published 0.5% total bridge fee, split
between the LP and the protocol. It's deducted destination-side from
the maker's locked amount:

| Party    | Source side | Destination side                    | Net per trade (1:1 cross-chain) |
| -------- | ----------- | ----------------------------------- | ------------------------------- |
| Bridger  | Deposits X  | Receives 0.995 × X                  | -0.5% × X                       |
| Maker    | Receives X  | Locked balance reduces by 0.997 × X | +0.3% × X                       |
| Protocol | —           | +0.002 × X to fee pool              | +0.2% × X                       |

Bps values are admin-configurable but timelocked, and capped at 100 bps
each in the contract to bound future admin-key abuse.

## The launch route — USDC ↔ USDC

ProofBridge does **not** issue tokens. T3 launches with one production
route between two existing token contracts:

| Side             | Asset                         | Issuer |
| ---------------- | ----------------------------- | ------ |
| Ethereum mainnet | USDC (ERC-20)                 | Circle |
| Stellar mainnet  | USDC (Stellar Asset Contract) | Circle |

ProofBridge configures the route via `set_token_route` on each chain
(timelocked); Circle's contracts are unmodified. Future routes —
including any native-token bridging (XLM, ETH) — wait for ecosystem
partners to issue equivalents on the counterpart chain. Adding a route
post-launch is config-only: `set_token_route` + `set_settlement_window` +
`set_bond_config`, all timelocked admin calls.

## Mainnet deployment is audit-gated

The SCF Audit Bank engagement runs during T3 and **gates** mainnet
deployment:

<Steps>
  <Step title="T2 contract code freezes">
    End of Phase 3 / Tranche 2. T3 contract changes (timelock, fee
    mechanism, per-route bond config) are staged but not yet deployed.
  </Step>

  <Step title="Audit kickoff">
    Auditors review the full T1 + T2 + T3 contract suite.
  </Step>

  <Step title="Critical / high findings closed">
    Audit Bank confirms remediation closure.
  </Step>

  <Step title="Mainnet deployment begins">
    Deploy contracts, run initial config, activate timelock, hand off
    admin to multisig.
  </Step>

  <Step title="Production routes verified">
    First-tx ceremony for the USDC route in both directions. Tx hashes
    recorded on `/reference/smart-contracts`.
  </Step>

  <Step title="4-week post-launch hardening">
    Daily uptime reports, audit medium/low remediation, integration
    partner support, perf tuning.
  </Step>
</Steps>

If audit timing slips, mainnet deploy slips. We don't ship a
known-broken launch.

## Trust model at mainnet

For the full per-phase trust comparison see the
[security model](/reference/security-model). At mainnet the residual
assumptions are bounded by:

* **Multisig + 24h timelock** on every admin operation that can move
  funds, redirect routes, or change auth gating.
* **Separate 5-of-7 arbiter multisig** with ≥ 2 non-team signers
  guaranteed in every decision. We engage the Stellar Foundation
  to source ecosystem signers for the multisig.
* **Cryptographic gates** (BLS aggregate + UltraHonk + nullifier +
  EIP-712 binding) unchanged from earlier phases.

The arbiter remains the largest residual trust assumption — Phase 5
addresses it by handing the role to DAO governance.

## What ships next

<Card title="Phase 5: Decentralization & Expansion" icon="arrow-right" href="/architecture/phase-5-followups">
  DAO governance for the ArbiterRole, agent stake-and-slash for
  misbehavior, additional chains and RWA routes via ecosystem
  partnerships, and protocol-level optimizations like per-route
  fee bps and oracle-driven cross-token bonds.
</Card>