Why a layered model
Most chains have a single source of security: the consensus protocol. If the validators are honest, the chain is safe. If they collude, the chain is broken. That's clean, but it puts everything on one assumption.
EDMA's security isn't a single assumption; it's a stack of three independent ones. Ethereum's Proof-of-Stake validators secure the chain at the cryptographic layer. PoV gate contracts enforce admissibility at the application layer. Attestor bonds in $EDM impose economic cost on bad attestations at the human layer. Any one of those layers failing doesn't break the rail. All three would have to fail at the same time. Each is independent of the others.
On top of those three layers sit the constitutional brakes. No EMT, no funds. One-Claim. Must-fund before shipping. Locked-to-Unlocked only on proof. 50% of every fee burns in $EDM. Those aren't policies that EDMA governance can change; they're contract-level invariants. Even if EDMA itself wanted to bypass them tomorrow, the chain would reject the transaction.
The three trust layers
- 01
Layer 1 (cryptographic): Ethereum Proof-of-Stake
EDMA posts batches and state roots to Ethereum every 2 to 10 minutes. The integrity of those posts is secured by Ethereum's validators and the economic finality of the PoS layer. Withdrawals, force-exits, and the 7-day fraud-proof challenge window all anchor here. EDMA inherits Ethereum's security without having to recreate it.
- 02
Layer 2 (admissibility): PoV gate at the contract level
Before any state change on EDMA L2, the PoV gate runs three sequential checks: Attestation Quorum (at least 2 distinct roles, AUDITOR required), Equality (all attestors signed the exact same hash), and One-Claim Exclusivity (the hash hasn't been finalised anywhere before). Any failure terminates the transaction. The check runs at the contract layer, in the same block as the mint or release. No frontend, no operator, no admin key can route around it.
- 03
Layer 3 (economic): attestor bonds in $EDM
Every registered attestor posts an $EDM bond per corridor and role. Bonds are locked for the term of the registration. Bad attestation behaviour, including missed SLAs, conflicts of interest, or material fraud, triggers a slashing ladder that can take up to 100% of the bond. Attestors don't just have reputational risk; they have economic skin in the game, denominated in $EDM.
How the slashing ladder works
Withhold (soft penalty)
If reversal rate >= 0.5% in a month, or on-time performance falls below 95% on any milestone, EDMA withholds a portion of the month's payouts pending cure. Two consecutive compliant months release the withheld amount. No bond is touched.
Slashing (material breach)
Fraud, falsification, repeated conflicts of interest, or a threshold of FAIL_SIG / FAIL_SCHEMA / FAIL_CONFLICT revocations in a rolling 30-day window triggers slashing of up to 100% of the posted bond, per a published schedule. Decisions are reasoned and appealable within a fixed window.
Suspension and delisting
For persistent breaches, EDMA suspends the attestor from affected corridors or roles. Emergency suspension is permitted when ongoing fraud or systemic failure is indicated. Repeated material breaches result in delisting from the Attestor Registry.
Independence rotation
Attestors cannot be the sole verifier on milestones that benefit their affiliated economic interests. EDMA may rotate attestors on high-volume lanes to preserve independence. Disclosure of ownership changes is required within a defined window.
