Chain Topology, UTXO Ownership, and Fee Model

Abstract

LP-0130 fixes three things that were previously implicit and drifting:

1. The canonical chain roster: exactly 10 chains — P, X (UTXO rails) plus C, D, Q, Z, A, B, M, F (execution/service lanes).
2. The UTXO ownership rule: only P and X are canonical UTXO state machines. Every other chain runs domain state and consumes UTXO settlement.
3. The fee model: X is the canonical fee-asset rail (LUX-denominated), P is the staking/reward rail, non-P/X chains meter locally and settle back to X (asset payouts) and P (staker rewards).

Anything that contradicts this LP is superseded by it. Chain-identity LPs (LP-1000/1100/1200/1300), chain-core LPs (LP-5000/6000/7100/8000/8200/9000), and the fee primitive package (chains/fee) all normatively reference this LP for the cross-chain money/staking model.

Motivation

The Lux stack shipped independent chain-core LPs, an IA lock (CHAIN-IA-2026-05-18.md), and a fee-settlement primitive (chains/fee) without a single spec that answered "where do assets live, what is a fee paid in, and how do worker rewards get home." Every non-P/X chain re-invented some fraction of the answer. Result: LP-1100 (X-Chain) framed X as an "Exchange Chain" with an order book, which now belongs to D-Chain (LP-9000); Q-Chain user-fee metering was left ambiguous; M-Chain modelled a user-visible fee balance that would force users to fund M before every bridge tx.

This LP is the single answer. It defines the two rails, one fee currency, one auditable escrow invariant, and one per-chain fee policy.

Specification

1. Canonical chain roster

Chain  Role                                                   VMID (chains/*)
─────  ────────────────────────────────────────────────────  ──────────────────
P      Platform: validator/staking/control-plane UTXO         platformvm (in node/vms/)
X      Exchange settlement: asset UTXO, transfer/import/       xvm       (in node/vms/)
       export, bridge lock/release settlement
C      Contract: EVM account state                            evm       (chains/evm)
D      DEX: CLOB matching + settlement receipts               dexvm     (chains/dexvm)
Q      Quantum: finality cert / Quasar aggregation state      quantumvm (chains/quantumvm)
Z      ZK: rollup / private commitment + nullifier state      zkvm      (chains/zkvm)
A      AI: attestation / inference receipt state              aivm      (chains/aivm)
B      Bridge: cross-chain message lifecycle state            bridgevm  (chains/bridgevm)
M      MPC: threshold signing / custody ceremony state        mpcvm     (chains/mpcvm)
F      FHE: encrypted state / ciphertext commitment state     (F-Chain runtime in
                                                                mpcvm/fhe today)

Chains outside this roster (schain S3 storage, keyvm K-Chain, identityvm I-Chain, graphvm G-Chain, relayvm R-Chain, oraclevm O-Chain) are service VMs, not canonical primary chains. They MAY exist as domain state machines but MUST NOT hold canonical UTXO asset supply, MUST fund their fee balance from X, and MUST settle rewards back through the same rails specified below.

2. UTXO ownership rule

Only P and X are canonical UTXO state machines.

P-Chain UTXOs cover validator stake, delegation stake, validator-set transitions, staking rewards, sovereign-network registration, chain-creation control transactions.

X-Chain UTXOs cover native assets, transfers, bridge lock/release settlement, DEX deposits/withdrawals, cross-chain import/export accounting.

Every other chain (C/D/Q/Z/A/B/M/F, and any service VM) MAY have:

• domain-specific state (accounts, orderbooks, cert stores, ZK commitments, ciphertexts, MPC session state, bridge messages, receipts)
• X-backed fee balances funded via ImportTx from X and refundable via ExportTx back to X
• P-backed reward accounting for stake-earning participants

None of them mints canonical asset supply. None of them owns transparent transferable assets except through X-backed references.

Z's shielded pool is a wrapper over an X-side escrow (Zcash transparent↔shielded model): mint burns X to establish shielded notes, burn withdraws X against a spend proof. There is no independent asset supply on Z, ever. Same for F: encrypted balances on F are ciphertexts over X-backed values; conservation must be provable against X.

3. Two rails

• X is the money rail. LUX (and any X-native asset) is the fee currency across all chains. ImportTx/ExportTx move balances between X and non-P/X chain fee accounts.
• P is the staking/reward rail. Validator and delegator rewards settle to P; asset payouts to non-staker workers (AI workers, MPC signers, FHE workers, relayers, LPs) settle to X.

4. Fee model (hybrid)

Two mechanisms coexist. Both are normative.

(a) User-facing fee funding — X ImportTx/ExportTx.

X ExportTx (user, LUX, target=C|D|Q|Z|A|B|M|F)
  → target chain ImportTx
  → local fee balance credited (chains/fee.Ledger.Credit)
  → execution meters + burns from local fee balance (chains/fee.Ledger.Burn)
  → remainder refundable via reverse ExportTx

chains/fee (balance.go/meter.go/settle.go) is the settlement primitive every non-P/X chain uses. Its Burn is a native LUX burn — no coinbase credit; supply reduces on X reconciliation.

(b) High-throughput settlement — epoch fee roots.

Each non-P/X chain accumulates fees in a local pool and commits an epoch fee root to X (and, where applicable, worker-reward roots) at a fixed cadence. X reconciles the burn against escrow, credits payouts to worker addresses, and Q anchors the settlement at finality.

Design invariant: user-facing operations use (a); sustained execution uses (b). Chains MUST NOT invent a third mechanism.

5. Fee currency

LUX-denominated fees everywhere. Non-LUX assets settle separately (X-native transfer flow, DEX pairs, etc.). A chain MUST NOT accept multiple X assets as fee currency in the same fee pool — that rebuilds an AMM inside every fee accountant. One money, one rail.

6. Q-Chain has no user-payable blockspace

Q-Chain (finality/checkpoint aggregation) is not user-fee-metered. Q cert inclusion is a validator obligation, paid via P reward distribution. Users never buy Q blockspace. This eliminates the finality-hostage failure mode where fee markets could stall safety.

7. M-Chain fees are service fees, not user balances

MPC signing sessions on M are triggered by other chains (B for bridge, F for threshold decrypt, C for account abstraction). M fees are service fees deducted from the originating chain's fee pool, settled to M signers via the epoch fee root. M does not have a user-facing fee balance and users do not fund M directly.

8. B-Chain fees deducted from bridged amount

B-Chain outbound (user → foreign) fees are deducted from the bridged amount. B does not run a user-visible fee balance. Relayer/attestor splits are internal accounting settled via B's epoch fee root.

9. A-Chain rides B's settlement engine

A-Chain's receipt→reward flow is structurally identical to B's attestation→settle flow. A MUST compose the same settlement engine (chains/fee + epoch fee roots), not duplicate it.

10. C-Chain is an account overlay on X-imported LUX

C-Chain (EVM) fees (gas) are paid from a C-account balance. That balance is X-imported LUX. C is a user-visible account overlay on X-imported LUX — same accounting rail as (a), user-visible frontend. Bridged non-LUX assets on C are ERC-20 wrappers over X-backed escrow.

11. Reward settlement direction

• Asset payouts (D LP fees, A worker rewards, B relayer fees, M signer fees, F worker rewards) → X.
• Staker rewards (validator and delegator P stakes) → P.

"Settled to X/P" always means "asset payouts to X, staker rewards to P."

12. Per-chain fee policy

Chain	Fee events	Paid from	Rewards / settle direction
P	staking tx, validator registration, chain/network creation	P UTXO	staker rewards on P
X	transfer, asset creation, import/export	X UTXO	— (source of truth)
C	EVM gas	C account (X-imported LUX)	worker/miner rewards → X
D	order placement/cancel, taker/maker, settlement	D fee balance (from X)	LP + fee split → X
Q	(none — validator obligation)	(P reward distribution)	validator rewards on P
Z	proof verify, rollup batch inclusion, private settle	Z fee balance (from X)	roots to X, rewards to X
A	inference receipt, model registry update, attest	A fee balance (from X)	worker rewards → X
B	bridge message + attestation + relayer	deducted from bridged amount	relayer/attestor rewards → X
M	MPC signing session, custody approval	originating chain's fee pool	signer rewards → X
F	FHE job, encrypted state update, threshold decrypt	F fee balance (from X)	worker + decrypt-committee rewards → X

13. Invariants

Enforced at every Q checkpoint. Any violation is a network-safety fault.

I-1. Canonical mint. No chain MAY mint canonical asset supply except through P/X rules.

I-2. Funded balance. Every non-P/X fee balance MUST be funded by an X/P import, a genesis allocation, or a finalized epoch fee settlement.

I-3. Reward settlement. Non-P/X worker rewards MUST be claimable/settled back to X (asset payouts) or P (staker rewards).

I-4. Finality unfettered. Q finality fees MUST NOT block safety. Q has no user-payable blockspace.

I-5. Private conservation. Z/F private state MUST prove conservation against X-backed commitments. Shielded/encrypted supply == X-side escrow.

I-6. Bridge accounting. B-Chain fees are message/relayer fees. B MUST NOT become the asset ledger — bridged canonical assets escrow on X.

I-7. MPC attestation. M signs/attests. M MUST NOT become the asset ledger — MPC-controlled assets reference X.

I-8. Σ-escrow equality (audit invariant).

Σ (non-P/X fee balances)  ==  Σ (X-side fee escrow)

At every Q checkpoint, the sum of all fee balances across non-P/X chains MUST equal the corresponding escrow held on X. Verification is by Q against the epoch fee roots each non-P/X chain commits. Drift is a finality-blocking fault.

14. Retirement notes

• LP-1100 §Exchange semantics (order book / matching) is superseded here. X is the asset-UTXO settlement layer; DEX/matching is D-Chain (LP-9000). LP-1100's cross-chain settlement scope remains authoritative for X.
• Service VMs (schain, keyvm, identityvm, graphvm, relayvm, oraclevm) are not promoted to canonical chains by this LP. They keep their existing domain state and, if fee-metered, MUST use chains/fee funded from X.

Rationale

• Two rails, one currency. Any richer model (multi-asset fees, per-chain currencies, D-Chain user balances shipped independently) requires each chain to internalise price discovery and asset routing. Collapsing to (X money, P stake, LUX everywhere) eliminates a class of coupling problems the existing chain-core LPs would otherwise re-invent one per LP.
• Hybrid fee model. Per-tx X↔local ImportTx roundtrip is too heavy for D/F/A throughput; per-chain fee roots reconciled at Q finality amortise the overhead. Both are needed; either alone fails.
• Σ-escrow invariant. Without I-8, "funded from X" is unverifiable and drift is inevitable. Q's finality is where we already stop the world; making it the reconciliation checkpoint is free.
• Q as validator obligation. User-fee-metered finality is a safety hazard — a hostile fee market on Q could deny finality. Delegating Q blockspace to a validator obligation paid via P eliminates that class of attack.
• M as service fees. Requiring users to fund M before every bridge tx is UX poison and creates a per-user M balance ledger nobody needs. Charging the originating chain's fee pool composes with existing bridge/decrypt/AA flows and settles once, at epoch.
• Z/F as X wrappers. A shielded chain with independent asset supply is a mint-authority proliferation. Modelling Z's pool as an X escrow with proofs at the boundary means the only mint authority is X.

Reference implementation

• chains/fee/ — settlement primitive (balance.go, meter.go, settle.go).
• chains/{aivm,bridgevm,dexvm,quantumvm,mpcvm,zkvm}/feegate.go — per-chain admission + settlement glue that MUST consume chains/fee.
• node/vms/platformvm — P-Chain UTXO state machine.
• node/vms/xvm — X-Chain UTXO state machine.
• Epoch fee root commit path: each non-P/X chain publishes a feeRoot alongside its block header at epoch boundary; Q aggregates and reconciles against X escrow.

Security considerations

• Escrow drift violates I-8 → Q rejects finality; chain halts until reconciled. Fail-closed.
• Q fee-market spoof is impossible: no user-payable Q blockspace exists.
• M signer griefing: M fees are pulled from originating chain's fee pool, not the user's M balance; a stalled M ceremony refunds via that pool's epoch settlement, not by user M-side action.
• Fee-currency collision (multi-asset fee pool) is disallowed by §5.
• Shielded mint attack on Z/F is prevented by I-5: any Z/F supply that does not reconcile to X escrow is a finality fault.

References

• CHAIN-IA-2026-05-18.md — chain-letter IA lock (numeric ranges).
• LP-0099 — LP numbering scheme.
• LP-1000 — P-Chain.
• LP-1100 — X-Chain (asset UTXO; exchange semantics superseded here → LP-9000).
• LP-1200 — C-Chain (EVM).
• LP-5000 — A-Chain.
• LP-6000 — B-Chain.
• LP-7100 — M-Chain.
• LP-8000 — Z-Chain.
• LP-8200 — F-Chain.
• LP-9000 — D-Chain.
• chains/fee/doc.go — settlement primitive.