The contracts behind Supermigrate's token bridging and token launches

The problem

Supermigrate put two jobs in one product. The first job bridged a project's existing token from Ethereum to an OP Stack network such as Base, as the canonical version. The network's own bridge mints and burns the canonical version. The second job launched new tokens with a market from the first trade.

A bridged token has to match its network's bridge exactly. It needs the bridge's address, the token it mirrors on Ethereum and the interfaces the bridge checks. If one of these is wrong, the token deploys but cannot be bridged.

The launch side handled the buyers' ETH. A bonding curve sells a new token for ETH until the sale ends and its liquidity moves to a pool. An error in the curve's accounting lets a buyer take ETH out.

What we built

We co-wrote the migration contracts with the client's engineers. Each network gets one implementation of the OP Stack's bridged-token standard. A factory makes a cheap clone of that implementation for each token, set up with the network's bridge and the token's address on Ethereum. Adding a token takes one call. Every token on a network runs the same code.

The clones cannot be upgraded. The token uses an upgradeable base only so that a clone can be set up after the factory creates it. Once a clone exists, nobody can change it. Nobody can patch a bug in place, but a holder never has to trust anyone not to change their token.

We wrote Launchbox, the launch contracts, from scratch: a token, a factory and an exchange. The exchange prices the token on a constant-product curve, the same math a Uniswap-style pool uses. A virtual ETH reserve keeps the first buys from being almost free. We moved the exchange to this curve from an earlier design built on the Bancor formula.

The client's engineers added the dollar pricing. The dollar pricing uses Chainlink's ETH price, with the pool on Aerodrome, an exchange on Base, as a fallback. The exchange refuses the trade when the two prices disagree by more than a set bound.

When the market cap reaches its threshold, the sale closes. The contract then puts all its tokens and ETH into an Aerodrome pool and burns the pool's LP tokens. With the LP tokens burned, nobody can ever pull that liquidity.

What was hard

The audit found that buying and immediately selling on the curve could turn a profit. The fee and reserve accounting let the round trip drain the curve's ETH.

We reworked that accounting. We added a test that buys and sells straight back, and fails unless the seller ends with less ETH than they started with. The same review found a path to create the pool before the sale had ended. We closed that path, so liquidity moves only when the sale ends. We also fixed how the first buy is assigned and the slippage bound on the move into the pool. The client's engineers fixed the other findings, including the price feed and the supply set at launch.

The result

We deployed the migration factory to Optimism and Mode. The migration factory and Launchbox are on Base. The links are under Public proof.

About $600M in tokens migrated from Ethereum to Base through Supermigrate, across 10 to 15 tokens. The figure is the market cap of every migrated token, in USD at each token's price when it migrated.

“Very easy to migrate with Supermigrate. The user experience is incredibly smooth and streamlined.”