canton: NTT layer on the keyless core bridge

[bengtlofgren]

Reworks the NTT (Native Token Transfers) layer to sit on the current Canton core bridge. It was originally built on the registry-keyed core, before three later changes reworked every core primitive it used: a per-consumer replay trie (#38, merged), removal of all contract keys (#39), and CIP-0056 fee payments (#40). It no longer built, and its inbound trust argument no longer held. Stacked on cs/canton-fees (#40, itself on cs/remove-keys #39).

Why the old NTT layer doesn't work

NTT's shape is a Manager plus a Wormhole transceiver — on Canton the transceiver is a core Emitter, so a send is an ordinary core publish and the guardian watcher needs no NTT-specific code. The old layer resolved everything through Daml contract keys: NttManagerRegistry keyed by operator, NttManager keyed by (operator, admin, id), and — critically — Receive resolved the CoreState by a key whose maintainer was guardianGovernance, arguing that a compromised operator could not substitute a forged guardian set because it could not produce that key.

That argument was already unsound under Daml-LF 2.3, where key lookups resolve against the submitter's own view with no maintainer attestation — which is exactly why #39 removed contract keys from the core. With keys gone, replay protection now a per-consumer trie (#38), and publishing now charging a fee (#40), none of the old flows compile or verify.

The rework

Keyless, direct-cid, disclosure-served. Every contract is resolved by an explicit contract-id served by the deployment's disclosure service (untrusted for safety, liveness-only — the same model the core uses). The manager and its transceiver churn on their consuming choices, so a sender re-resolves fresh cids per send, failing closed on staleness.

Crankless, permissionless deployment. A deployer exercises RegisterManager directly on the disclosed NttManagerRegistry; the operator's co-signature on the manager is inherited from the registry signatory, so the guardian operator runs no approval crank (mirroring the core's direct RegisterEmitter). Manager and transceiver addresses stay owner-bound — admin is in the preimage and co-signs — so a compromised operator cannot forge an existing deployment's address.

Sends are permissionless and the sender self-pays. Transfer's sole controller is the sending user; the operator/admin authority the nested lock-or-burn and publish need is inherited from consuming the manager. Every Wormhole message pays a fee, no exceptions — and the sender pays its own message fee, from its own wallet. This needed a small core-fee change (in #40): PublishMessage now charges its payer, and payer co-controls the publish, so the user's authority reaches the fee's allocation transfer even though the shared transceiver Emitter is owned by admin. The transceiver has to be shared — its derived address is the peer identity other chains register — so per-user emitters, which would otherwise make the user the publisher, are not an option; the payer seam is what lets the user foot the fee anyway.

Receive is permissionless — any third-party executor. Anyone relays an inbound VAA on the recipient's behalf. Receive is nonconsuming, so the operator/admin authority every nested action needs is inherited from the manager's signatories regardless of who submits; the executor's identity carries no authority, only the disclosures it attaches. Replay protection is the core per-consumer trie, scoped to the deployment's admin.

The guardian trust root is pinned to guardianGovernance, not the operator. The old key-maintainer guarantee is replaced by an explicit pin: the disclosed CoreState's guardianGovernance must equal the anchor the admin committed at deployment (via a new GetGuardianGovernance read choice). This is deliberately stronger than pinning the operator: a CoreState requires only some (operator, gg) signature pair, so an operator whose hot key is compromised could co-sign a forged CoreState under a throwaway gg party and an attacker guardian set that would pass an operator-pin. guardianGovernance is the guardians' k-of-n external threshold party, which a single operator key cannot forge — pinning it closes that hole and preserves the compromised-operator defense the original design targeted. (The core reference integrator still pins only the operator; worth revisiting separately.)

Recipient binding. A Canton Party has no fixed-size address, so Receive binds the caller-supplied recipient to the VAA's own recipientAddress as keccak256 over the Party-id string — a value the sender fixes off-chain and the guardian signature covers, so no relayer can steer the mint. This permanently binds a signed VAA to the recipient party as it existed when the sender hashed it; a party that must change requires a re-send (chosen deliberately over a repointable-handle registry).

Token-standard DARs are shared with the core fee path — one vendored interface set under dars/, with burn-mint and transfer-instruction added for the CIP-0056 token hooks.

See canton/README.md §11 for the full design.

🤖 Generated with Claude Code

[bengtlofgren]

@cursor review?

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[bengtlofgren]

Closing this in favor of wormholelabs-xyz/native-token-transfers#36, which ports this branch's NTT layer to the native-token-transfers repo (Canton's canonical home for NTT, matching the EVM/Solana/Sui convention). All the design work here — GetGuardianGovernance, the crankless registration redesign, the replay-trie migration — carried over; the GetGuardianGovernance core choice itself already landed separately via #41.

#36 is currently open pending a required code-owner review on that repo, not yet merged. Once it lands, this branch's content will live there instead of here.

Thanks for the work on this — closing as superseded, not as a rejection of the design.