proxmox/docs/07-ccip/NON_PREFUNDED_AVAX_MIGRATION_RUNBOOK.md

Non-Prefunded AVAX Migration Runbook

Date: 2026-03-04
Scope: Replace inventory-backed AVAX settlement behavior with a non-prefunded bridge path for future transfers.

0. Status Update (2026-03-30)

The non-prefunded AVAX cW route is now live and proven end to end.

Live contracts:

• AVAX send router: 0x1773125b280d296354f4f4b958a7cfc4e5975b60
• AVAX cW relay router: 0xc9158759a7e3621f6bb191bf5d77605d6e25b410
• AVAX cW bridge: 0x635002c5fb227160cd2eac926d1baa61847f3c75
• Chain 138 relay router: 0xe75d26bc558a28442f30750c6d97bffb46f39abc
• Chain 138 cW L1 bridge: 0x152ed3e9912161b76bdfd368d0c84b7c31c10de7

Verified forward proof:

• Source send tx on Chain 138: 0xb6b821d3a04739c0f548fe1e30f4f162392c12a06930757bacdb940dc87f05b5
• Forward message ID: 0x8aa12010aece5f29396fbe84ed4f18554661f8a77238895c433367276110dc8f
• AVAX relay tx: 0x79aa31eefe427270bd03e04e4e52bf7c8eeab9dd1af6519ebdef132a334189c5
• Result: 1.0 cWUSDT minted to 0x4A666F96fC8764181194447A7dFdb7d471b301C8 with no AVAX-side WETH prefunding

Verified reverse proof:

• Burn/send tx on AVAX: 0x303d2ceb2d0489dcb504b8d36aeb6a87e0b3d613896957d339dfe60e81f0df4e
• Reverse message ID: 0x70f24209fa4c66462fd53aa7c0621b956a126ab6762587d251db8f756b6bc0ab
• Chain 138 relay tx: 0xa8c13b255afe0d79bfa74372c0c253f0e6463f5cb19f7f0df9c746d77f557395
• Result: 0.1 cWUSDT burned on AVAX and 0.1 cUSDT released on Chain 138

Operational note:

• The legacy AVAX WETH route still uses the older AVAX relay router and WETH bridge.
• The non-prefunded AVAX cW route uses the dedicated avax-cw relay profile and router above.
• Reverse avax-to-138 delivery requires legacy gas-priced tx submission on Chain 138 (RELAY_DEST_LEGACY_TX=1).

Native AVAX WETH status check (2026-03-30)

The canonical AVAX-side WETH9 bridge is not a live non-prefunded first hop from the current Chain 138 router.

Live proof:

• Chain 138 destination was temporarily updated to native AVAX bridge 0x24293CA562aE1100E60a4640FF49bd656cFf93B4:
  • tx 0xec9dfd938f61d6a1afbfc829b9c5c390175dff30f86ecadad1495dce2101b1f9
• WETH approval:
  • tx 0x081c6e8290837ef4cc52a1557ba24a22c3cf51c950e395789fde4b0957b82deb
• LINK approval:
  • tx 0x61291b94b174698057f3aa89b01e542853614cdc5d342e753b4637abeea5f45c
• Test send 0.001 WETH:
  • tx 0x473595564d011a4c852975cf9727cc05828bb458bcaa3e024dd279d3b75a26ee
  • message 0x42f8a362dd622cbedd3ef1f098b9a88b0e935ca2d9c0f9a84346842ff32cf0e4
• Chain 138 destination was then restored to relay bridge 0x3f8C409C6072a2B6a4Ff17071927bA70F80c725F:
  • tx 0x6843767ab6412a3450efe5f1e3121ebe7e143a45960e1fa09ffc48cf44f36845

Observed result:

• processedTransfers(messageId) on the native AVAX bridge stayed false
• Native AVAX bridge WETH balance stayed 0
• Recipient WETH balance on AVAX stayed 0

Root cause:

• Chain 138 source bridge uses router 0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
• Native AVAX bridge only trusts router 0xF694E193200268f9a4868e4Aa017A0118C9a8177
• CCIPWETH9Bridge.ccipReceive is protected by onlyRouter, so the native AVAX bridge never accepted the message

Operational conclusion:

• Keep AVAX WETH on the legacy relay-backed path when canonical destination WETH is required
• Treat the cW route as the actual non-prefunded AVAX solution

1. Problem Statement

Current 138 -> AVAX flow is inventory-backed:

• Source bridge on 138 escrows WETH.
• Destination bridge must already hold AVAX-side WETH to pay recipients.
• If destination inventory is zero, messages remain unprocessed.

This does not satisfy the requirement "move value to AVAX without pre-funding AVAX bridge inventory."

2. Target Architecture

Use a lock/mint or burn/mint path for the bridged asset, not release-from-inventory.

Recommended implementation in this repo:

1. Use dedicated receiver model from CW_BRIDGE_APPROACH.md (Option 2).
2. Bridge a mintable wrapped representation (for example cW* family), not canonical AVAX-side WETH.
3. Convert destination minted asset to required target assets through DEX routing.

Notes:

• Canonical WETH itself cannot be minted by your bridge contracts.
• If you require canonical WETH/AVAX output directly, you must use an external canonical bridge/protocol that supports that asset path.

3. Execution Order

Phase A: Stop Further Loss Exposure

1. Freeze large 138 -> AVAX sends on inventory-backed bridges.
2. Add preflight guard: block sends when destination delivery model is inventory-backed and inventory is below requested amount.
3. Keep BSC relay running only if still needed for legacy pending messages.

Phase B: Recover Existing Stuck Message(s)

1. Enumerate pending message IDs (processedTransfers == false) on AVAX bridge.
2. For each pending message, either:
   • fund destination bridge inventory and relay once, or
   • implement explicit source-side refund path (if contract supports it; current WETH9 bridge does not expose one).
3. Verify each recovered message transitions to processedTransfers == true.

Phase C: Deploy Non-Prefunded Path

1. Deploy/verify destination mintable token(s) and grant bridge roles:
   • MINTER_ROLE and BURNER_ROLE to dedicated receiver (TwoWayTokenBridgeL2 or equivalent).
2. Deploy sender/receiver pair:
   • L1 sender/lock bridge on 138.
   • L2 receiver/mint bridge on AVAX.
3. Configure chain selector mapping and router support for AVAX selector 6433500567565415381.
4. Wire fee token and fee approvals.
5. Register token mapping in routing/config files.

Phase D: E2E Validation (Required Before Production)

1. Test amounts: 0.01, 1, 20 units.
2. Validate:
   • source escrow/burn,
   • destination mint,
   • no destination inventory dependency,
   • reverse path burn/send works if required.
3. Run consistency tests for quote/fee, message replay protection, and mapping correctness.

Phase E: Cutover

1. Mark legacy AVAX inventory-backed route as deprecated.
2. Update all operator scripts/docs to new route.
3. Keep monitoring and alerting on:
   • message backlog,
   • mint/burn failures,
   • fee-token depletion.

4. Acceptance Criteria

Migration is complete only when all are true:

1. A 138 -> AVAX transfer succeeds when destination bridge token inventory is 0.
2. No relay payout from destination inventory is required.
3. End-to-end tests pass at small and medium sizes.
4. Runbooks/scripts no longer route AVAX through legacy inventory-backed path by default.

Current status against acceptance criteria:

• 1 complete for the cUSDT -> cWUSDT path
• 2 complete for the cUSDT -> cWUSDT path
• 3 complete at small size (1.0 forward, 0.1 reverse)
• 4 complete for the non-prefunded cW path; legacy WETH route remains separate by design and the native AVAX WETH first hop is not live from the current Chain 138 router

5. Immediate Operator Commands (Verification)

Check legacy destination dependency:

cast call 0x24293CA562aE1100E60a4640FF49bd656cFf93B4 "processedTransfers(bytes32)(bool)" <message_id> --rpc-url https://avalanche-c-chain.publicnode.com
cast call 0xa4B9DD039565AeD9641D45b57061f99d9cA6Df08 "balanceOf(address)(uint256)" 0x24293CA562aE1100E60a4640FF49bd656cFf93B4 --rpc-url https://avalanche-c-chain.publicnode.com

Check source escrow:

cast call 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 "balanceOf(address)(uint256)" 0xcacfd227A040002e49e2e01626363071324f820a --rpc-url https://rpc-http-pub.d-bis.org

6. Related Files

• docs/07-ccip/CW_BRIDGE_APPROACH.md
• docs/11-references/CCIP_138_DESTINATION_RECEIVER_BY_CHAIN_AND_TOKEN.md
• smom-dbis-138/contracts/bridge/TwoWayTokenBridgeL1.sol
• smom-dbis-138/contracts/bridge/TwoWayTokenBridgeL2.sol
• smom-dbis-138/contracts/bridge/CWMultiTokenBridgeL1.sol
• smom-dbis-138/contracts/bridge/CWMultiTokenBridgeL2.sol
• smom-dbis-138/contracts/tokens/CompliantWrappedToken.sol
• smom-dbis-138/services/relay/.env.avax
• smom-dbis-138/services/relay/.env.avax-cw
• smom-dbis-138/services/relay/.env.avax-to-138