GNOT and BUBBLE, between gno.land and other chains

Send GNOT or BUBBLE from gno.land to Solana and back. On gno.land your coins go into a lock a realm holds; on Solana you get the same amount of a token that stands for them, one to one. Burn that token on Solana and the lock pays you back on gno.land. Solana is the first chain; others can follow the same way.

How it is checked

Every change on Solana is a proof of a gno.land block. Solana accepts a transfer only after checking that more than two thirds of gno.land's validators signed the block it came from; nobody's machine stands in that path.

Burns back are confirmed by three machines until Solana's own proofs arrive: two of the three must agree on a burn before gno.land credits it. They can pay a claim that never happened — slowly, under a cap, until governance voids it — and they can stop; they can never mint. Two watchers compare both sides every ten seconds: the lock on gno.land must equal the supply on Solana plus what is owed. If it ever does not, payouts stop.

Who can stop it

Four guardians hold pause keys and nothing else: one flag pauses, two flags hold. A hold lasts until the two lift it, or until governance replaces them — on the hold's 21st day at the earliest. GovDAO decides after a 7-day wait; until Jae yields to GovDAO, his key decides, with the same 7-day waits, and GovDAO's proposals are refused. A flag can delay a decision; it can never cancel one. There is no admin key on Solana: the program that carries out decisions can never be changed, and it acts on nothing but a decision proven from a gno.land block.

The honest limits

Caps bound the loss. A day's payouts on gno.land are at most a tenth of the lock (never below a floor), one recipient gets a quarter of that, and a transfer is at most 25,000 per message. If the three machines stop, nobody leaves Solana until governance swaps them: 7 days plus the swap. GovDAO's two-thirds vote can replace gno.land's validators in one block, and nothing here stops it; the week of delays buys holders time to leave, about half the lock in seven days. Until the yield to GovDAO one key decides, so the lock stays small and no outside audit has read the code yet. A transfer can be late — a header must pass it, the relayers retry hourly — but it is not lost: a send waits in the lock, a burn waits as a claim.

Two endings no rule here prevents. If more than two thirds of gno.land's validator keys were stolen, Solana could not tell a forged block from a real one: the guardians' hold and the 7-day wait give governance time to cancel each forged decision, the caps bound what leaves meanwhile, and the cure is a new validator set and a new deployment. If Solana's check of gno.land ever stops working — the chain forks, or its validators change in a way the check cannot follow — sends to Solana stop for good while burns back keep working, so every holder can still come home, and governance deploys the bridge again.

The figures live on the Status page; the fees, the delays and what to do when something is late are on Help.