The stablecoin bridge
Rand issues one asset, RAND, and its price moves. A shielded pool with nothing stable to hold is of limited use for payments, so USDT and USDC are imported from the chains where they already circulate and minted, less a 0.1% bridge fee, as zUSD: one shielded dollar, backed by the combined USDT and USDC reserves, held as notes in the same pool as everything else and redeemable for either coin on demand.
The alternative is to wait for Tether and Circle to issue natively, which is a commercial decision made against volume the chain does not yet have. Bridging needs no cooperation from the issuer. The cost is a longer credit chain and a custodian of our own — and this page states that cost plainly rather than glossing over it.
- Stablecoins locked
- —
- every accepted coin, all four chains
- USDT locked
- —
- Tether USD
- USDC locked
- —
- USD Coin
- zUSD supply
- —
- the token registry's total, one-to-one against what is locked
| Chain | Token | Minted today | Daily cap | Locked |
|---|
Reading the bridge from the explorer…
Lock
USDT or USDC is deposited into the custody contract on its home chain and immobilized there. The contract only ever locks and releases; it never mints anything.
Attest
Guardians watch the registered emitter on each source chain, wait for confirmation depth, and sign what they saw. Six of eight signatures form a quorum. They attest that a message was published, not what it means.
Mint
Rand verifies the quorum, a second post-quantum quorum by the same guardians, and the emitter binding; checks that reserve's mint cap and the global one over the last 24 hours; marks the attestation spent; and inserts a note commitment into the shielded pool, for the deposit less the bridge fee (0.1% since chain 20, kept as a zUSD note for the treasury). From this point the asset is a zUSD note, indistinguishable from any other note in the anonymity set.
Redeem
The holder spends the note in one transaction that names the coin, the destination chain and the address, and pays a 0.01 RAND bridge fee. Since chain 20 the chain also keeps 0.1% of the amount as a zUSD fee note, and the release is the amount less that fee. Rand refuses it if that coin's reserve holds less than the amount. The nullifier is published first, then guardians attest the burn, then custody releases. The claim is destroyed before the collateral moves, never after.
The value locked is public at the boundary. Every transfer of the note afterwards is not. The privacy boundary is the bridge itself: what enters is transparent, what circulates on Rand is shielded.
One token, seven reserves
zUSD is a single token, but its backing is counted reserve by reserve: a reserve is one coin on one home chain, keyed on the pair and not on the symbol. USDT locked on Ethereum and USDT locked on Tron sit in separate custody, and Rand records what each has locked. A redemption names its coin and chain and is refused if that reserve holds less than the amount, so a redemption on one chain cannot draw on the custody of another. zUSD supply equals the sum of the seven by construction.
Wire values carry eight decimals. Where a token uses eighteen, the contract locks only the representable amount; where it uses six, a redemption must be a whole number of the coin's own smallest unit. Either way no locked unit is left without an attestation that can release it.
| Chain | Coins | Standard | Custody | Confirmation | Decimals |
|---|---|---|---|---|---|
| Ethereum | USDT, USDC | ERC-20 | Lock contract | 32 blocks | 6 |
| Binance Smart Chain | USDT, USDC | BEP-20 | Lock contract | 20 blocks | 18, truncated to 8 on the wire |
| Tron | USDT | TRC-20 | Lock contract | 20 blocks | 6 |
| Solana | USDT, USDC | SPL | Custody program | Finalized slot | 6 |
Eight guardians, six to sign
A guardian set is an ordered list of attestation keys. A message is attested when more than two thirds of them sign it: the Byzantine threshold of the validator set, applied to a committee that watches chains Rand's validators cannot see from inside consensus. The format is Wormhole's, ported rather than reinvented, so the guardian, the Solidity verifier and the Rust verifier can be checked against one another.
A mint on Rand needs a second quorum as well: six of the same eight guardians sign the same digest with Dilithium2, bound to the Rand chain, and Rand refuses a mint that lacks either. A release on a source chain still rests on the secp256k1 quorum alone.
Attestation is not authorization
Guardians attest to publication. They watch a message-emitting contract, wait for confirmations, and sign what they observed. They do not interpret the payload. If the message layer accepts messages from any caller, then any party able to submit a source-chain transaction can cause the mint of an arbitrary quantity of zUSD without corrupting a single guardian key: the guardians' attestation is truthful, because the message was in fact published.
What prevents the mint is not signature verification but emitter binding: the destination accepts an attestation only if it came from the registered bridge contract for the chain the attestation itself names. On a permissionless message layer, signature validity does not imply authorization, and this binding is the load-bearing check.
What bounds the damage
None of these makes the bridge trustless. Each converts a failure from unbounded to bounded, or from silent to observable.
Custody soundness
Thm 9.13Each chain counts what it holds and refuses to release more than that, and Rand keeps the same count per reserve and refuses a redemption above it. A forged attestation cannot withdraw money that was never locked there, so an unbounded minting failure becomes a bounded custodial one.
Emitter binding
Def 9.7 · Cor 9.8An attestation is accepted only if it was emitted by the registered bridge contract for the chain named in the attestation itself. Without this, anyone able to publish a message on a source chain could mint at will with honest guardians signing truthfully.
Replay protection
Def 9.10Every attestation is redeemable exactly once, keyed by its digest, and every redemption publishes a nullifier. Neither a mint nor a release can be replayed.
Supply auditability
Thm 9.14Shielded supply equals public mints minus public burns, and the peg condition against custody is checkable by anyone without opening a note. In-pool transfers conserve value by construction, so they cannot move the total.
Caps and pause
Rem 9.16On the current testnet each reserve can mint at most 100,000 zUSD, and all seven together at most 4,000 zUSD, in any rolling 24 hours. One pause key, held apart from the guardian keys, can halt minting at once. It cannot resume it: that takes the post-quantum guardian quorum, which can also replace the pause key, and redemptions stay open throughout. The source contracts keep their own pauser and rate caps. These bound the exposure; they do not remove it.
Confirmation depth
Guardians sign only after the source chain has settled the lock, so a reorganised deposit cannot back a mint.
The weakest component
Everything else in the protocol reduces to cryptographic hardness or to a Byzantine bound over a staked, slashable validator set. The bridge does not, and the paper says so in those words. The zUSD paper's Proposition 2.8 argued against exactly this construction; it is reproduced unaltered because it is still correct, and since every zUSD backing is an attested leg, the guarantee on every unit is the lesser of custody solvency and dual guardian-threshold integrity.
- ›A quorum of guardian keys can release the entire custodied balance on every chain. There is no fraud proof, no challenge window and no optimistic delay. A valid quorum signature is the authorization.
- ›Guardians are neither bonded nor slashable by Rand's consensus. The losses in this bridge class — Ronin, Wormhole, Nomad, Harmony — came from key compromise and verification bugs, not consensus failures.
- ›If one machine holds six keys, that machine is the bridge. Distinct operators, jurisdictions and key hardware are a deployment requirement, not a configuration preference.
- ›zUSD is one pooled asset: a claim on Rand's custody, which is a claim on Tether and on Circle. Every holder carries both issuers' risk whichever coin they deposited, plus guardian risk, and the last is the weaker link by a wide margin.
- ›No independent audit has been performed. The contracts have been deployed on four mainnets since 19 September 2026 and hold real USDT, under caps of 100 per transfer and 1,000 a day per token. One operator holds every guardian key today: six on separate hosts and two on a laptop.
The frontier
Consensus, privacy and attribution are post-quantum: STARK soundness, a 384-bit transcript hash, Dilithium signatures. Guardian attestations over secp256k1 are not, and the release path still rests on them alone. A quantum adversary recovers every guardian key from its published public key and releases the entire custodied balance. The system's post-quantum security is the minimum over its components, and on the release side this component is zero bits until it migrates.
The verifier is Rand's own execution layer, which already verifies Dilithium. Every mint now carries, beside the secp256k1 quorum, a Dilithium2 quorum by the same guardians over the same digest, so recovering the secp256k1 keys is no longer enough to forge a mint. Since chain 15 the post-quantum quorum can rotate its own set and the pause key, each rotation signed by the current set; on chain 20 a rotation also needs proof that the new keys are held, and takes effect a day after it is accepted.
Ethereum, Binance Smart Chain, Tron and Solana verify secp256k1 natively. ML-DSA verification in contract code costs millions of gas today. The release path stays classically secured until the source chains ship post-quantum precompiles, and Rand cannot advance that date on its own.
What follows for operators
The residual exposure is capped by custody, not by shielded supply, and it shrinks as the bridge is used for flow rather than storage. Holding large idle balances on the source side is the configuration that maximizes quantum-era loss, so custody caps should be set accordingly. The trust-minimized replacement is already in the system's toolbox: a STARK verifying a source chain's consensus would reduce the bridge's assumption to that chain plus STARK soundness and remove the guardian set entirely. The obstacles are proving cost and per-chain engineering, not a missing primitive.
Implementation status
A reference implementation exists: custody contracts for the EVM chains and Tron, a custody program on Solana, a guardian that watches all chains and serves assembled attestations, and a shared codec for the wire format, carried in the fullnode as the bridge-codec crate so a wire-format change in one language fails the tests in the others. On the Rand side the full node has implemented the receiving half since shielded-pool phase S3: an attestation deposits one note the chain computes from the attested amount, a bridged holding is a note in the same pool as RAND, and a burn is one transaction with one proof. A chain turns the bridge on with a section in its genesis. The current testnet, chain 20, has it on: eight guardians, eight post-quantum guardians, a pause key and a 4,000 zUSD daily global mint cap are in its genesis, and so is zUSD with its seven reserves, carrying over the zUSD outstanding at the cut, with the custody still locked for it. Its genesis names the Ethereum, BNB Chain and Tron bridge endpoints redeployed on 30 September 2026, and charges 0.1% in zUSD on every mint and every burn, so supply still equals the custody locked for it. A round trip on each source chain was run on chain 14 on 20 September 2026. The figures at the top of this page are read from chain 20.
The contracts, the guardian and the relayer are public at github.com/randprotocol/bridge, and the deployed addresses with their transactions are listed in its mainnet deployment record. The endpoints have been live on Ethereum, BNB Smart Chain, Tron and Solana since 19 September 2026, each token capped at 100 per transfer and 1,000 a day. Custody holds real value: 10 USDT on 30 September 2026, backing the 10 zUSD in circulation. No independent audit has been performed, and one operator holds every guardian key.
Read the specification
Section 9 of the protocol paper specifies the bridge: the attestation format, emitter binding, the shielded mint and redemption, custody soundness, supply auditability, and the post-quantum asymmetry. The zUSD paper covers the reserve invariant, the cost of bridging stated as a proposition, and the loss bounds the chain-14 deployment carries.