# CCIP Bridge Setup Guide

## Overview

This guide covers the complete setup and operation of CCIP WETH9/WETH10 bridges between ChainID 138 and Ethereum mainnet.

## Architecture

### Contract Addresses (Deterministic)

Both chains use the same addresses:

- **WETH9**: `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`
- **WETH10**: `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f`
- **CCIP WETH9 Bridge**: `0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6`
- **CCIP WETH10 Bridge**: `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e`
- **CCIP Router**: `0x80226fc0Ee2b096224EeAc085Bb9a8cba1146f7D`
- **LINK Token**: `0x514910771AF9Ca656af840dff83E8264EcF986CA`

### Logical Lanes

- **Lane A**: WETH9 on Chain 138 ↔ WETH9 on Ethereum mainnet
- **Lane B**: WETH10 on Chain 138 ↔ WETH10 on Ethereum mainnet

### CCIP Chain Selectors

- **Ethereum Mainnet**: `5009297550715157269`
- **Chain 138**: `<YOUR_CHAIN138_SELECTOR>` (to be configured)

## Environment Setup

### Step 1: Create Environment Files

Copy the example files and fill in your values:

```bash
# For Ethereum mainnet
cp terraform/phases/phase1/config/.env.mainnet.example .env.mainnet
# Edit .env.mainnet with your values

# For Chain 138
cp terraform/phases/phase1/config/.env.chain138.example .env.chain138
# Edit .env.chain138 with your values
```

### Step 2: Configure Environment Variables

**For `.env.mainnet`:**
- Set `RPC_URL` to your Ethereum mainnet RPC endpoint
- Set `PRIVATE_KEY` to your admin private key
- Set `MIRROR_ADMIN` to your admin address (multisig recommended)
- Set `ETHERSCAN_API_KEY` for verification

**For `.env.chain138`:**
- Set `RPC_URL` to `https://rpc.d-bis.org` (or your Chain 138 RPC)
- Set `PRIVATE_KEY` to your admin private key
- Set `CHAIN138_SELECTOR` to your official CCIP chain selector
- Set `CHAIN138_ETHERSCAN_API_URL` and `CHAIN138_ETHERSCAN_API_KEY`

## Bridge Configuration

### Step 1: Configure Destinations

**On Chain 138 (configure → Mainnet):**

```bash
# Load Chain 138 environment
source .env.chain138

# Configure WETH9 bridge
export BRIDGE_ADDRESS=$CCIPWETH9_BRIDGE_CHAIN138
./terraform/phases/phase1/scripts/ccip/ccip-configure-destination.sh \
    5009297550715157269 \
    0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6

# Configure WETH10 bridge
export BRIDGE_ADDRESS=$CCIPWETH10_BRIDGE_CHAIN138
./terraform/phases/phase1/scripts/ccip/ccip-configure-destination.sh \
    5009297550715157269 \
    0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
```

**On Mainnet (configure → Chain 138):**

```bash
# Load Mainnet environment
source .env.mainnet

# Configure WETH9 bridge
export BRIDGE_ADDRESS=$CCIPWETH9_BRIDGE_MAINNET
./terraform/phases/phase1/scripts/ccip/ccip-configure-destination.sh \
    $CHAIN138_SELECTOR \
    0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6

# Configure WETH10 bridge
export BRIDGE_ADDRESS=$CCIPWETH10_BRIDGE_MAINNET
./terraform/phases/phase1/scripts/ccip/ccip-configure-destination.sh \
    $CHAIN138_SELECTOR \
    0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
```

### Step 2: Verify Configuration

Verify that remote bridges are configured correctly:

```bash
# On Chain 138
cast call $CCIPWETH9_BRIDGE_CHAIN138 \
    "remoteBridges(uint64)(address)" \
    5009297550715157269 \
    --rpc-url $RPC_URL

# Should return: 0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6
```

## Fee Estimation

### Estimate Fee Before Sending

```bash
# Load environment
source .env.chain138

# Set bridge address
export BRIDGE_ADDRESS=$CCIPWETH9_BRIDGE_CHAIN138

# Estimate fee for 0.1 WETH (100000000000000000 wei)
./terraform/phases/phase1/scripts/ccip/ccip-estimate-fee.sh \
    5009297550715157269 \
    0xYourMainnetReceiverAddress \
    100000000000000000
```

## Sending Tokens

### Step 1: Approve Bridge

Before sending, approve the bridge to spend your tokens:

```bash
# For WETH9
cast send $WETH9_ADDRESS \
    "approve(address,uint256)(bool)" \
    $CCIPWETH9_BRIDGE_CHAIN138 \
    1000000000000000000 \
    --private-key $PRIVATE_KEY \
    --rpc-url $RPC_URL

# For WETH10
cast send $WETH10_ADDRESS \
    "approve(address,uint256)(bool)" \
    $CCIPWETH10_BRIDGE_CHAIN138 \
    1000000000000000000 \
    --private-key $PRIVATE_KEY \
    --rpc-url $RPC_URL
```

### Step 2: Dry Run (Optional)

Test the transaction without actually sending:

```bash
export BRIDGE_ADDRESS=$CCIPWETH9_BRIDGE_CHAIN138

./terraform/phases/phase1/scripts/ccip/ccip-send.sh \
    --selector 5009297550715157269 \
    --receiver 0xYourMainnetReceiverAddress \
    --amount 100000000000000000 \
    --dry-run
```

### Step 3: Send Tokens

```bash
export BRIDGE_ADDRESS=$CCIPWETH9_BRIDGE_CHAIN138

./terraform/phases/phase1/scripts/ccip/ccip-send.sh \
    --selector 5009297550715157269 \
    --receiver 0xYourMainnetReceiverAddress \
    --amount 100000000000000000
```

## Monitoring

### Check Bridge Events

**BridgedOut events (source chain):**
```bash
cast logs \
    --from-block 0 \
    --address $BRIDGE_ADDRESS \
    "BridgedOut(uint64,address,address,uint256,bytes32)" \
    --rpc-url $RPC_URL
```

**BridgedIn events (destination chain):**
```bash
cast logs \
    --from-block 0 \
    --address $BRIDGE_ADDRESS \
    "BridgedIn(uint64,address,address,uint256,bytes32)" \
    --rpc-url $RPC_URL
```

### Verify Message Delivery

Use CCIP explorer or check router logs to verify message delivery.

## Security Checklist

- [ ] Access control on `configureDestination` is restricted to owner/admin
- [ ] Router address is immutable or only changeable by owner
- [ ] Remote bridge mapping only accepts specific chain selector → address pairs
- [ ] `_ccipReceive` validates source chain selector and sender
- [ ] Re-entrancy protection on bridge functions
- [ ] Pausing mechanism implemented (if needed)
- [ ] Replay protection using messageId mapping
- [ ] Fee handling (native vs LINK) is correct
- [ ] Bridge contracts hold sufficient LINK (if using LINK fees)

## Troubleshooting

### Transaction Fails with "Insufficient Fee"

- Check fee estimation: `./ccip-estimate-fee.sh`
- Ensure bridge has enough LINK (if using LINK fees)
- Ensure transaction includes enough native ETH (if using native fees)

### Transaction Fails with "Insufficient Approval"

- Approve bridge to spend tokens before sending
- Check approval amount is sufficient

### Message Not Received on Destination

- Verify destination is configured correctly
- Check CCIP router logs
- Verify source bridge address matches configured remote bridge
- Check for paused bridges or other restrictions

## Next Steps

1. Deploy bridge contracts (if not already deployed)
2. Configure destinations on both chains
3. Fund bridges with LINK (if using LINK fees)
4. Test with small amounts
5. Monitor bridge events and CCIP router logs
6. Scale up to production amounts

## Related Documentation

- `GENESIS_PREDEPLOY_INSTRUCTIONS.md` - Genesis file predeploy setup
- `HIGH_PRIORITY_TASKS_COMPLETE.md` - Infrastructure setup
- CCIP Documentation: https://docs.chain.link/ccip

