Design Token Bridge - System Design | WinJob

Token-bridge focus (sec-01)

A token bridge moves fungible assets (ERC-20, SPL, native gas tokens) across chains by locking canonical supply on a source ledger and minting a mapped representation on a destination ledger. Unlike generic message buses, every transfer must preserve decimals, asset identity, and corridor caps so USDC on Ethereum cannot become a different USDC.e on Polygon. Wormhole Portal, Polygon PoS Bridge, and Celer cBridge all implement lock-mint variants with different guardian economics, but interviews converge on the same accounting invariant: outstanding wrapped mints never exceed provably locked collateral.

Problem Statement: Fungible Token Bridge

Design a production token bridge that locks collateral on a source chain, verifies finalized deposit events, and mints wrapped assets on a destination chain with quorum-gated authorization. This section covers problem during the understanding phase.

Mechanism

lock assets on source chain; mint wrapped representation on destination
relayers or guardians observe source finality before authorizing mint
withdraw burns wrapped tokens then unlocks native collateral on source
bridge TVL is the sum of locked native assets backing wrapped supply

Design narrative

Anchor on trust-minimized lock-mint where Wormhole, Axelar, and LayerZero differ on verification mechanics but share collateral accounting discipline. Interviewers probe whether you treat bridges as "APIs between chains" instead of state machines with safety invariants—keep mint authorization tied to finalized proofs. For Problem Statement: Fungible Token Bridge, quantify TVL, corridor throughput, and finality minutes before naming relayer vendors or cloud services. Mechanism slice problem must show how a reorg on Ethereum can invalidate a proof that already minted on Polygon—your rewind policy is the smoking gun detail. Failure drills for understanding: forged quorum signatures, relayer censorship, destination congestion, and wrapped surplus after exploit—each needs detect → pause → reconcile. Staff+ depth: batch attestation for same-block deposits, ZK wrapper roadmap, governance timelock on guardian rotation, and chaos tests that partition 40% of validators. Operational note 1: support macros map user-facing "pending" to proof_lag_seconds and quorum_completion_rate, not just destination mempool time. Compare to liquidity networks: lock-mint is slower but keeps collateral visible on source; use that contrast when interviewer pushes for Hop/Stargate patterns. Depth note 1.1 for problem: explain how lock assets on source chain; mint wrapped representation on destination interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes. Depth note 1.2 for problem: explain how relayers or guardians observe source finality before authorizing mint interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes. Depth note 1.3 for problem: explain how withdraw burns wrapped tokens then unlocks native collateral on source interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes. Depth note 1.4 for problem: explain how bridge TVL is the sum of locked native assets backing wrapped supply interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes. Depth note 1.5 for problem: explain how lock assets on source chain; mint wrapped representation on destination interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes. Depth note 1.6 for problem: explain how relayers or guardians observe source finality before authorizing mint interacts with finality windows, quorum signatures, and TVL reconcilers when understanding load spikes.

Invariants

Safety: no mint without finalized inclusion proof + quorum signatures.
Accounting: locked native on source ≥ wrapped outstanding on destination.
Liveness: honest minority relayers can progress transfers after outages.

Interview checkpoint (sec-01-understanding)

Lead with lock assets on source chain; mint wrapped representation on destination and cite confirmation counts.
Explain how problem fails if proofs are built from non-finalized blocks.
Tie Problem Statement: Fungible Token Bridge to incident response: pause, TVL reconcile, surplus burn.

javaOne Dark Pro

1 public enum BridgeState { DEPOSITED, PROVEN, MINTED, BURNED, UNLOCKED }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class DepositEvent:
5     transfer_id: str
6     asset: str
7     amount: int

typescriptOne Dark Pro

1 export function canMint(state: BridgeState, attestations: number, need: number): boolean {
2   return state === "PROVEN" && attestations >= need;
3 }

Why interviewers care

Token Bridge interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Fungible Token Bridge that proves you understand real outages, not happy-path diagrams.

Key Highlights

•lock assets on source chain; mint wrapped representation on destination
•relayers or guardians observe source finality before authorizing mint
•withdraw burns wrapped tokens then unlocks native collateral on source
•bridge TVL is the sum of locked native assets backing wrapped supply

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class DepositEvent:
5	transfer_id: str
6	asset: str
7	amount: int

1	export function canMint(state: BridgeState, attestations: number, need: number): boolean {
2	return state === "PROVEN" && attestations >= need;
3	}