OIP-198: Expand OHM Bridging with Chainlink CCIP

amnoodle

Summary

Approve the expansion of OHM bridging through Chainlink CCIP to Arbitrum, Optimism, Base, and Berachain, while preserving the existing Ethereum-Solana route.

The launch will use an Ethereum lock/release pool, Olympus-controlled burn/mint pools on the four EVM destination chains, independent rate limits for every route and direction, a one-day delay for routine route changes, and immediate route containment for the DAO and Emergency Multisigs.

Motivation

OHM bridging on Arbitrum, Optimism, Base, and Berachain has been unavailable since the LayerZero V1 bridge was disabled. OIP-197 proposed restoring those routes through LayerZero V2. Since then, Olympus has expanded its relationship with Chainlink. Using CCIP for the EVM rollout restores bridging without maintaining two bridge systems.

This OIP supersedes the LayerZero V2 rollout proposed in OIP-197.

Proposal

Authorize the deployment, configuration, and activation of the Chainlink CCIP bridge described below. Approval authorizes the relevant Olympus multisigs to complete the coordinated L2 and Solana actions, and authorizes submission of the on-chain governance proposal that configures Ethereum.

Architecture

Ethereum: the existing Chainlink LockReleaseTokenPool locks OHM sent out and releases OHM returning to Ethereum. It does not mint OHM.
Arbitrum, Optimism, Base, and Berachain: each chain uses an Olympus CCIPBurnMintTokenPool. OHM is burned when it leaves and minted when it arrives.
User-facing bridge: each EVM chain uses a CCIPCrossChainBridge periphery to quote fees, send messages, deliver OHM to the recipient, and record failed deliveries for permissionless retry. Users may also call the Chainlink router directly, so emergency containment is enforced at the token pools rather than by disabling the periphery.
Configuration: each EVM pool is owned by a CCIPTokenPoolConfig policy. Routine route changes are queued through a CCIPTokenPoolConfigTimelock and may be executed permissionlessly after the delay.

Supported Routes at Launch

Every marked route is bidirectional.

	Ethereum	Arbitrum	Base	Optimism	Berachain	Solana
Ethereum		✓	✓	✓	✓	✓
Arbitrum	✓		✓	✓	✓
Base	✓	✓		✓	✓
Optimism	✓	✓	✓
Berachain	✓	✓	✓
Solana	✓	✓	✓	✓	✓

Chainlink does not currently provide a direct lane between Optimism and Berachain. Transfers
between those chains can route through another supported network.

Initial Rate Limits

Each direction of each route has its own refillable bucket. Capacities are available immediately and refill continuously at the specified rate, which restores approximately one full capacity per day. All on-chain values use OHM base units with 9 decimals.

Transfer direction	Source capacity / refill	Destination capacity / refill
Ethereum to an EVM destination	100,000 OHM / 1.157407407 OHM per second	110,000 OHM / 1.273148148 OHM per second
An EVM destination to Ethereum	50,000 OHM / 0.578703703 OHM per second	55,000 OHM / 0.636574074 OHM per second
One EVM destination to another	100,000 OHM / 1.157407407 OHM per second	110,000 OHM / 1.273148148 OHM per second
An EVM chain to or from Solana	10,000 OHM / 0.115740740 OHM per second	11,000 OHM / 0.127314814 OHM per second

The destination capacity is higher than the matching source capacity because a source bucket can begin refilling while prior transfers are still awaiting delivery.

Launch Parameters

Parameter	Initial value
Routine configuration delay	1 day
Permitted delay range	1 to 30 days
Execution window after the delay	3 days
Policy recovery grace period	3 days
Maximum sub-actions per batch	15
Maximum configuration keys per batch	24
Native pool `rateLimitAdmin`	Zero address
`bridge_rate_limiter` role	Unassigned
EVM periphery receiver gas limit	275,000 gas
Minimum OHM delivery gas budget for a burn/mint destination	175,000 gas
Minimum Ethereum pool backing	130,721 OHM

The Ethereum backing requirement is the aggregate OHM supply outstanding on the four EVM destination chains, rounded up to a whole OHM. It must be recalculated immediately before funding; the on-chain proposal will refuse to build or validate if the pool holds less than the configured minimum.

The 175,000 gas minimum applies to every lane whose destination is one of the four burn/mint pools, including lanes originating on Solana. Chainlink must configure those fee entries before the corresponding routes open. The 275,000 gas periphery limit is separate: it covers the EVM receiving contract's failure-recording path so a failed delivery remains retryable through the Olympus periphery.

Authority Model

Authority	Ethereum	Arbitrum, Optimism, Base, and Berachain
Kernel executor	Ethereum DAO Multisig	Local DAO Multisig
`admin` role	OCG timelock	Local DAO Multisig
`bridge_admin` role	Ethereum DAO Multisig	Local DAO Multisig
`emergency` role	Emergency Multisig	Emergency Multisig
`bridge_rate_limiter` role	Unassigned	Unassigned
OHM administrator in `TokenAdminRegistry`	OCG timelock	Local DAO Multisig
Token pool owner	`CCIPTokenPoolConfig`	Local `CCIPTokenPoolConfig`
Config operator	`CCIPTokenPoolConfigTimelock`	Local `CCIPTokenPoolConfigTimelock`
Native pool `rateLimitAdmin`	Zero address	Zero address
Lock/release pool rebalancer	OCG timelock	Not applicable
`CCIPCrossChainBridge` owner	Ethereum DAO Multisig	Local DAO Multisig

The authority addresses at launch are:

Authority	Address
OCG timelock	`0x953EA3223d2dd3c1A91E9D6cca1bf7Af162C9c39`
Ethereum DAO Multisig	`0x245cc372C84B3645Bf0Ffe6538620B04a217988B`
Arbitrum DAO Multisig	`0x012BBf0481b97170577745D2167ee14f63E2aD4C`
Optimism DAO Multisig	`0x559a14a2219Ae81f9a9f857CF31407de2b07F36c`
Base DAO Multisig	`0x18a390bD45bCc92652b9A91AD51Aed7f1c1358f5`
Berachain DAO Multisig	`0x91494D1BC2286343D51c55E46AE80C9356D099b5`
Emergency Multisig	`0xa8A6ff2606b24F61AFA986381D8991DFcCCd2D55`

The DAO Multisig may queue changes to routes, remote tokens, accepted remote pools, allowlists, and rate limits. After the one-day delay, anyone may execute a queued action during the three-day execution window. A queued action is rejected if the affected configuration changed after it was queued.

The DAO and Emergency Multisigs may immediately reduce one route or all routes to an effectively unusable capacity. Restoring approved limits must go through the normal timelock or admin. The Emergency Multisig may also disable the configuration policies and cancel queued actions. Within three days of a policy disable, the DAO Multisig may restore the configuration policy or its timelock without changing configuration; after that, restoration requires admin. A disabled L2 burn/mint pool can only be restored by the local admin.

Ethereum On-Chain Proposal

The on-chain proposal is named CCIP Bridge Activation and is proposal ID 19 in the deployment repository. It adds only the actions still required by live state, up to the following 12 actions:

Accept the OHM administrator role in Chainlink's TokenAdminRegistry without changing the registered pool.
Grant bridge_admin to the Ethereum DAO Multisig.
Enable CCIPTokenPoolConfig.
Accept ownership of the Ethereum lock/release pool through CCIPTokenPoolConfig.
Set CCIPTokenPoolConfigTimelock as the config operator.
Set the OCG timelock as the pool rebalancer.
Clear the pool's native rateLimitAdmin.
Enable CCIPTokenPoolConfigTimelock.
Add the Arbitrum route.
Add the Base route.
Add the Berachain route.
Add the Optimism route.

The proposal validates contract bindings, versions, policy lifecycle, ownership, registry authority, roles, launch parameters, route configuration, pool backing, Chainlink fee entries, and continued ownership of the Ethereum periphery by the DAO Multisig. It fails closed if the live state differs from the approved configuration.

Launch Sequence

The launch is staged so the new burn/mint pools remain dormant until Ethereum governance has approved and opened its side of the routes.

Deploy and verify the burn/mint pool, configuration policies, configuration timelock, and periphery on each EVM destination chain. Deploy and verify the two new configuration policies on Ethereum.
Transfer each local OHM registry administrator to the local DAO Multisig, propose each CCIPTokenPoolConfig as owner of its pool, and transfer each periphery to the local DAO Multisig. On Ethereum, prepare the corresponding ownership and registry handovers for acceptance by the OCG timelock.
Have Chainlink configure the required OHM delivery gas budgets for every lane into a burn/mint destination.
Recalculate the outstanding L2 supply and fund the Ethereum lock/release pool from the DAO Multisig to at least the configured minimum.
Require the aggregated EVM and Solana readiness checks to pass before submitting the on-chain proposal. Publish all deployment addresses and verification links.
During the on-chain voting period, configure the EVM destination policies and routes, including their Solana routes, while leaving every burn/mint pool disabled and unregistered. In the same setup, deactivate the legacy LayerZero bridge policy only after verifying it is already closed to traffic and has no OHM mint approval.
Pass, queue, and execute the Ethereum on-chain proposal.
After execution, configure the four new remote chains on the Solana pool. Then enable each EVM burn/mint pool and register it in the local TokenAdminRegistry.
Configure trusted remotes and gas limits for each periphery and enable the four new EVM peripheries.

If the Ethereum proposal fails, the new L2 pools remain disabled and unregistered. No rollback is required. Between execution of the Ethereum proposal and final registration of an L2 pool, a message sent toward that chain may enter CCIP's failure state; it can be executed permissionlessly after finalization. Operators should minimize this interval by preparing the Solana and L2 multisig actions in advance and executing them consecutively.

Activation Conditions

No new route may be opened until all of the following conditions are satisfied:

Contract-level tests, cross-chain fork rehearsals, and the final security review are complete.
All production contracts are deployed, verified, and published.
Contract ownership, registry authority, roles, and policy state match the authority table above.
The Ethereum pool holds at least the freshly recalculated backing requirement.
Chainlink's required OHM delivery gas entries are live.
The EVM and Solana readiness reports pass for every route in the launch configuration.

Risks and Trade-offs

Chainlink dependency: a Chainlink outage or defect can delay or disrupt transfers. Independent route limits and emergency containment reduce exposure but do not remove this dependency.
Compromised destination chain or pool: an affected chain could create or release invalid OHM. Per-route limits restrict how quickly that OHM can move, while the finite Ethereum pool limits what can be released there.
Privileged authority compromise: the Ethereum DAO Multisig cannot make routine pool changes without the one-day queue, although it can contain routes. Local DAO Multisigs hold direct admin authority on their respective L2s. The Emergency Multisig may contain routes and cancel queued actions.
Configuration or rollout error: desired-state checks, proposal validation, deployment verification, and staged activation reduce this risk. A short recoverable failed-message window remains between Ethereum execution and each destination's final registration.
Smart-contract risk: the expansion introduces new Olympus configuration contracts and depends on existing Olympus and Chainlink bridge contracts. Activation is conditional on final security review and rollout rehearsals.

Vote

For: approve the Chainlink CCIP bridge expansion and launch configuration described in this OIP.
Against: do not approve the expansion or its launch configuration.