Frontier
← Home
Frontier

Frontier chain: technical design

Updated October 28, 2026

Status: draft v0.2, 28 October 2026 (bridging section corrected after the scaffold review). Author: Frontier project. Published for community and engineering review before any build starts.

Scope: this document covers the project's own blockchain ("Frontier chain"), which is Phase 5 of the roadmap. It is not a commitment to launch. Nothing here changes the FRNT token on Base, which stays a fixed 20,000,000 supply ERC-20 at 0x1727609cFc529d8A711d40766CF9BB11062538fF (chain 8453).

Everything priced below is an estimate from public sources as of October 2026. Rollup-as-a-service vendors mostly quote privately; where a number is not published we say so.

1. Summary and recommendation

Recommendation: an OP Stack L3 that settles on Base, using OP Stack Custom Gas Token v2 so FRNT is the native gas token, operated for the first 12 to 18 months by a rollup-as-a-service provider (Conduit "Pro" tier is the reference quote), with Base-posted data availability at launch and a published path to self-hosting and shared sequencing.

Fallback: if, at the time the launch trigger fires, OP Stack CGT v2 is still not running in production on any mainnet chain we can point to, deploy an Arbitrum Orbit L3 on Base instead. Orbit has supported custom gas tokens in production since 2024 and the token requirements match FRNT, but it carries a 10% net-revenue licence fee when the parent chain is not Arbitrum One or Nova.

Why L3 on Base and not an L2 on Ethereum:

  • FRNT already lives on Base. An L3 on Base means the canonical bridge is Base to Frontier chain, one hop, and the token never has to be re-issued on Ethereum L1.
  • Base is where contributors, the treasury Safe and the lock contracts are. Settlement and fraud-proof costs are paid in Base gas, which is cents, not Ethereum L1 gas.
  • Posting data to Base instead of Ethereum blobs is the cheapest default; an alt-DA layer (Celestia, EigenDA) remains an option if volume grows.

Why not just stay on Base: today there is no technical reason to leave. The chain is justified only when (a) FRNT-denominated fees make economic sense for the community, (b) we need block space or custom precompiles for mission data (telemetry, prospecting data sets, research publication, grant accounting) that general-purpose Base does not give us, and (c) the project can fund two engineers and an audit. That is why launch is gated on the triggers in section 12.

2. Stack comparison

2.1 OP Stack (Optimism, "Superchain" lineage, Base-compatible)

  • Custom gas token. The original beta was deprecated by OP Labs in early 2025. A new implementation, Custom Gas Token v2 (CGT v2), shipped as part of OP Stack Upgrade 18, which passed Optimism governance on 3 February 2026 (vote.optimism.io). The chain-operator guide is live (docs.optimism.io CGT guide) and the feature overview is at docs.optimism.io/op-stack/features/custom-gas-token. The spec is still labelled experimental (specs.optimism.io).
  • Token requirements (CGT v2): standard ERC-20 on the parent chain, exactly 18 decimals, name and symbol at most 32 bytes, no fee-on-transfer, no rebasing, no transfer hooks. FRNT meets every one of these (18 decimals, no fees, no hooks, no admin functions).
  • Standard Rollup / Superchain status. A CGT chain is not a "Standard Rollup" under the Superchain charter; op-deployer's standard-config validation rejects CustomGasToken.Enabled = true (per the Cantina audit summary, cantina.xyz). That means no Superchain Registry listing and no Superchain revenue-share obligation, and also no Superchain interop. For an L3 on Base this is acceptable.
  • Base's February 2026 stack change. Base announced it is moving to its own unified base/base codebase, stopped sharing sequencer revenue with Optimism, and says it stays compatible with the OP Stack specification (The Defiant, Unchained). An L3 only needs Base to be an EVM chain with reliable finality, so this does not block us, but it does mean "Base-compatible" now means "settles on Base", not "shares Base's exact client".
  • Sequencer HA: op-conductor gives Raft-based leader election across a 3-node sequencer cluster (docs.optimism.io/op-stack/components/op-conductor). Conduit has its own equivalent, Elector (blog.conduit.xyz).
  • Licence fee: none for a non-Superchain chain. (MIT-licensed code.)
  • Risk: CGT v2 is new, is incompatible with legacy CGT chains, and has no migration path from legacy. Fee parameters (minBaseFee, operatorFee) must be set so FRNT fees cover Base-denominated data costs; mis-setting them either bleeds the operator or overcharges users (CGT guide).

2.2 Arbitrum Orbit

  • Custom gas token: supported on both AnyTrust and Rollup chains (docs.arbitrum.io, Rollup, AnyTrust). Requirements: ERC-20 with a parent-chain representation, direct transfers/approvals, no rebasing, no transfer fees, no callbacks. FRNT qualifies.
  • Fee token pricer: a Rollup-mode Orbit chain needs a "fee token pricer" contract that converts parent-chain costs into FRNT (manual rate, oracle, or batch-poster tracking). Arbitrum's example pricers are unaudited; we would have to audit ours.
  • Licence fee: the Arbitrum Expansion Program takes 10% of net protocol revenue (gross fees minus settlement costs) for chains that settle anywhere other than Arbitrum One/Nova (docs.arbitrum.io/launch-arbitrum-chain/chain-config/costs/calculate-aep-fees, AEP terms). Settling on Base triggers this. At the revenue levels we expect in year one it is small in dollars, but it is a permanent obligation on a chain whose point is community ownership.
  • Maturity: custom gas tokens have run on Orbit chains in production since 2024; this is the lowest-risk path for the gas-token feature specifically.
  • Sequencer decentralisation: Espresso has an Orbit integration for confirmations and shared sequencing (docs.espressosys.com); no major production rollup had migrated to it as of October 2026.

2.3 Rollup-as-a-service providers (either stack)

Provider Published pricing (Oct 2026) Notes
Conduit Trial testnet $250/month. Growth and Pro: "contact for pricing" plus 5% of sequencer profit. Custom gas tokens listed under the Pro tier. Mainnet indexing $500/month, Pro RPC $50/month for 1B CU. (conduit.xyz/pricing/rollups) Only vendor with a public price sheet. Supports OP Stack and Orbit.
Caldera AWS Marketplace listing shows a "rollup pod" at $500/month plus explorer and infrastructure dimensions (AWS Marketplace); otherwise negotiated, with a sequencer revenue share. Runs ApeChain, Manta, Plume.
AltLayer No public pricing found. Restaked-rollup focus.
Gelato No public pricing found. OP Stack and Orbit.

Third-party guides estimate a managed chain at $3,000 to $15,000 per month all-in depending on configuration (blockeden.xyz forum) and $5,000 to $25,000 per month including L1 gas (eco.com guide). Treat these as ranges, not quotes. We will request written quotes from all four before committing and publish the chosen contract's headline terms.

2.4 Decision matrix

Criterion (weight) OP Stack L3 on Base Orbit L3 on Base Score note
FRNT as gas token works today (3) 2 (v2 new, spec experimental) 3 (production since 2024)
Licence/revenue obligation (3) 3 (none) 1 (10% net revenue)
Same lineage as Base, tooling familiarity (2) 3 2
Bridge simplicity from Base (2) 3 (native CGT deposit via OptimismPortal) 2 (needs pricer + Arbitrum bridge)
Path to shared/decentralised sequencing (1) 2 2
Vendor support (1) 3 3
Weighted total (max 36) 31 25

OP Stack wins on cost structure and alignment; Orbit wins on gas-token maturity. The fallback rule in section 1 handles that single weakness.

3. FRNT as the gas token: mechanics

Design on OP Stack CGT v2:

  1. The L1 (here: Base) SystemConfig records FRNT's Base address as the gas-paying token at deployment and flags isCustomGasToken. The flag must never be changed after launch.
  2. Genesis supply. CGT v2 mints an initial native-asset supply into a NativeAssetLiquidity contract on the L3 at genesis (default type(uint248).max), controlled by a liquidity-controller owner. Deposits from Base unlock native FRNT from this pool; withdrawals lock it back. Because FRNT is fixed-supply, the total FRNT circulating across Base plus Frontier chain never exceeds 20,000,000: every native FRNT on the L3 is backed one-for-one by FRNT held in the Base-side portal contract.
  3. Liquidity controller owner is set to the treasury Safe (2-of-2 today, see treasury policy). It must not be an EOA.
  4. Fees. Users pay gas in FRNT. The sequencer receives FRNT. The operator must periodically convert part of that FRNT to ETH on Base to pay data-posting and proposer costs; the protocol does not do this conversion. We set minBaseFee and operatorFee from a published formula (section 7) and review monthly.
  5. Sequencer fee destination. Sequencer fees go to a fee vault whose withdrawal target is the treasury Safe on Base. Fee revenue is mission income and enters the public ledger like any other inflow.
  6. ETH on the L3. ETH is not native. Bridged ETH is an ordinary ERC-20 on Frontier chain via the StandardBridge. WETH9 at the predeploy wraps FRNT, not ETH; UI copy must say so.

Things that would break this and must be checked in the audit: the OptimismPortal must never be able to call the FRNT contract address with arbitrary calldata; FRNT has no hooks so the known double-entrypoint and callback issues do not apply.

4. Bridging FRNT from Base

Correction, 28 October 2026 (v0.2). The deposit path described below (OptimismPortal.depositERC20Transaction) belongs to the legacy, experimental custom-gas-token design. Under Custom Gas Token v2, which is what the current op-deployer configures, the L3's native FRNT is minted at genesis into a NativeAssetLiquidity contract and released by a LiquidityController; moving FRNT between Base and Frontier chain requires an authorised-minter bridge built at the application layer. That is new code, so the audit scope in section 9 must include it and the risk table's "no novel bridge code at launch" assumption no longer holds. The engineer's first task (see chain/README.md, section 3.5) is to design that bridge: lock FRNT on Base in an audited escrow, mint native FRNT on the L3 through the liquidity controller, and reverse on withdrawal, with a bridged-value cap for the first 90 days. The paragraphs below are kept for the record and will be rewritten once that design exists.

Canonical path (as originally drafted, now superseded for deposits):

  • Deposit: user calls OptimismPortal.depositERC20Transaction on Base after approve-ing the portal for FRNT. The deposit is included on the L3 within the sequencer's confirmation window (seconds). Native FRNT is credited.
  • Withdrawal: user calls L2ToL1MessagePasser.initiateWithdrawal on Frontier chain; after the fault-proof window (7 days under the standard permissioned/permissionless game) the user proves and finalises on Base and receives ERC-20 FRNT. We will publish an explicit "withdrawals take up to 7 days plus Base finality" notice.
  • The bridge UI is a static page on thefrontier.space that talks only to the verified portal addresses; addresses are published in site.js and on the explorer.

Non-canonical, later: a fast-withdrawal liquidity provider (third party) or a LayerZero/Across route can be added only after the canonical bridge has run for at least one quarter and after a separate audit of any adapter. Not in the 12-month plan.

Migration of locks and treasury: the team lock, community lock and treasury Safe stay on Base. Nothing forces them to move. Community reward distributions can be paid on either chain; recipients choose.

5. Sequencer

  • Phase A (testnet, mainnet months 1 to 6): single sequencer operated by the RaaS provider with their HA setup (Conduit Elector or op-conductor 3-node cluster) across at least two regions. We own the sequencer key via the Safe; the provider holds the operational signer with a published rotation procedure.
  • Phase B (mainnet months 7 to 12): self-hosted HA sequencer using op-conductor, 3 nodes across 3 availability zones, with the RaaS provider retained for RPC and explorer only. This is when we need our own devops engineer.
  • Phase C (year 2+): shared or decentralised sequencing. Candidates: Espresso Network (live as a permissioned ~100-node network with OP Stack and Nitro integrations; the permissionless phase was targeted for late 2025 to 2026) and whatever the OP Stack ships natively. As of October 2026 no major production rollup had publicly migrated to Espresso (eco.com, orochi.network). We commit to a decision on Phase C only when one of those is proven on a chain with real value, and we put that decision to a community vote.
  • Forced inclusion via the Base-side portal is enabled from day one so a censoring sequencer cannot block withdrawals.

6. Data availability

Option Cost reference (Oct 2026) Use case
Post to Base (L3 default) Base median transaction cost about $0.05 (spark.money); batches are a few Base transactions per minute at low volume Launch default. Simplest, inherits Base's own blob posting to Ethereum.
Ethereum blobs direct (if we were an L2) about $0.0325/MB 30-day average, Growthepie via Cryptopolitan, 22 Sep 2026 Not applicable to an L3.
Celestia (alt-DA) about $0.0188/MB (same source) If mission data (telemetry, imagery) grows past tens of GB/month.
EigenDA (alt-DA) about $0.0363/MB (same source); reserved-bandwidth tiers Higher throughput; pricier at our scale.

At launch volumes (say 50,000 transactions/day, roughly 100 bytes compressed each = 5 MB/day = 150 MB/month) the DA bill is a rounding error on every option. The choice is about security assumptions, not cost: posting to Base keeps the L3 inside Ethereum's security chain via Base; alt-DA introduces a second trust assumption. Start on Base DA; revisit only if monthly data exceeds about 5 GB.

7. Fee formula (published, reviewed monthly)

Let P = FRNT/ETH price from the on-chain Base pool (TWAP, 30 minutes). Let C_base = measured Base cost per L3 batch in ETH. Then:

  • l1FeeScalar is set so that expected FRNT collected per batch = C_base / P × 1.25 (25% buffer for price moves).
  • minBaseFee is set so the cheapest transaction costs at least the FRNT equivalent of US$0.001, to prevent spam when FRNT is cheap.
  • operatorFee covers the provider's fixed monthly cost divided by trailing-30-day transaction count, capped so no single transaction pays more than the FRNT equivalent of US$0.02.

The numbers go in the monthly "state of Frontier" post. If FRNT has no liquid pool yet, the chain does not launch on mainnet (see triggers).

8. Infrastructure: explorer, faucet, RPC

Component Testnet Mainnet year 1 Notes
Block explorer Blockscout, provider-hosted (included in Conduit chain tiers) Blockscout, provider-hosted, then self-hosted on a 8 vCPU / 32 GB box with an archive node Blockscout is open source (GPL-3.0). Hosted plans listed from $49/month in a third-party listing (itechguides); self-host cost is mostly the archive node.
Public RPC Provider RPC free tier (100M CU/month on Conduit) Provider Pro RPC $50/month for 1B CU, plus one self-run full node as fallback Rate-limit per IP; publish limits.
Faucet Testnet FRNT faucet: 10 tFRNT per address per day, GitHub or email sign-in, Cloudflare Turnstile Not needed on mainnet Testnet FRNT is a separate throwaway token with no value.
Bridge UI Static page, verified contract addresses Same No backend; reads Base and L3 RPC directly.
Indexer / API Provider mainnet indexing $500/month Same, or self-hosted Ponder/subgraph Powers the public treasury page and ledger.
Monitoring Grafana + Prometheus from the provider Self-hosted Grafana, PagerDuty free tier, status page Status page public at status.thefrontier.space.
Chain registry Chainlist entry, eth_chainId reserved via ethereum-lists/chains PR Same Pick a chain ID and reserve it before testnet.

9. Security audits and controls

What needs auditing (we do not re-audit upstream OP Stack contracts, which OP Labs has had audited; we audit our configuration and anything we add):

  1. Deployment configuration and genesis (CGT flag, liquidity controller owner, fee vault recipients, proxy admin ownership). Small scope, 1 week.
  2. Fee-token economics and any FRNT-to-ETH conversion automation (keeper that sells sequencer FRNT for ETH on Base). 1 to 2 weeks.
  3. Bridge UI and any adapter contracts (none at launch).
  4. Operational security review: key custody, sequencer key rotation, Safe signer policy, incident response.

Budget: a reputable firm's configuration-plus-economics review runs US$25,000 to US$100,000; bridge or novel-contract work runs US$150,000 to US$500,000 (smartcontractaudit.com guide, 7blocklabs). Because CGT v2 requires an application-layer bridge (section 4 correction), the audit must cover that bridge as well as configuration; we budget US$60,000 for the pre-mainnet configuration audit, US$80,000 to US$150,000 for the bridge audit, plus US$20,000 for a re-audit after fixes (re-audits typically 30 to 50% of the original). A Cantina or Sherlock contest with a US$30,000 pool is an optional add-on before mainnet.

Standing controls:

  • Proxy admin owner and liquidity controller owner = treasury Safe. Add a third, independent signer and move to 2-of-3 before mainnet (see treasury policy).
  • A 48-hour timelock on any L1-side upgrade, with the timelock address published.
  • Bug bounty on Immunefi or self-hosted, paid in USDC, from mainnet day one: critical up to US$50,000.
  • Fault proofs: launch with the permissioned dispute game, move to permissionless once the chain holds more than US$1M in bridged value or after 6 months, whichever is first.

10. Team

Minimum to launch and run year one:

Role FTE When Indicative cost (NZD/year)
Protocol / smart-contract engineer (lead) 1.0 Month 1 180,000 to 240,000
Infrastructure / devops engineer 1.0 Month 1 160,000 to 200,000
Front-end engineer (bridge, explorer skin, faucet) 0.5 contract Months 2 to 6 60,000
Security auditor (external) engagement Months 7 to 9 100,000 to 130,000 (US$60k to 80k)
Community/ops (existing) 0.2 ongoing existing

Roadmap item 36 already says two engineers plus an auditor. That is the floor, not a comfortable number.

11. Twelve-month plan

Clock starts the month the launch trigger is confirmed and both engineers have started.

Month Milestone Exit criteria
1 Vendor quotes, chain ID reserved, repo and CI, decision OP vs Orbit confirmed against live CGT v2 status Written quotes from at least 3 providers; design doc v1.0 published
2 Testnet launch on Base Sepolia settlement: explorer, faucet, RPC, bridge UI Public testnet live; 10 community members have bridged tFRNT
3 Fee formula implemented; FRNT-to-ETH keeper on testnet; monitoring and status page 30 days of uptime data published
4 Load test (target 100 tx/s sustained for 1 hour); incident drill (sequencer failover) Failover under 60 seconds in drill
5 Community testnet programme (rewards points for bug reports and app deployments) At least 5 third-party contracts deployed on testnet
6 Code freeze for audit; documentation complete Audit scope signed
7 to 8 External audit; fixes All high/critical findings closed
9 Re-audit; Safe moves to 2-of-3; timelock deployed; bug bounty opened Re-audit report published
10 Mainnet candidate: deploy with 1,000 FRNT bridged by the team only; 2-week soak Zero critical incidents in soak
11 Community vote on mainnet opening date (roadmap item 37) Vote passes with published quorum
12 Mainnet public launch; bridge opens; first community distribution offered on Frontier chain Launch post with all addresses; ledger entry for every launch cost

Months 13 to 18: self-host sequencer (Phase B), permissionless fault proofs, evaluate alt-DA and shared sequencing.

12. Launch triggers (from the roadmap, made precise)

The build (month 1 above) starts only when all of the following hold, verified in a monthly report:

  1. 10,000 or more unique FRNT holders on Base (addresses with balance above 1 FRNT, excluding the treasury, locks and liquidity pool), or US$1,000,000 or more raised in total contributions on the public ledger.
  2. A liquid FRNT/ETH pool exists on Base with locked LP (roadmap item 20), so the fee formula has a price source.
  3. Treasury holds at least 18 months of the chain's running cost (section 13) in USDC/ETH in addition to the ordinary reserve required by the treasury policy.
  4. Two engineers hired or contracted, and an auditor shortlisted.
  5. The legal entity exists and a lawyer has confirmed that operating a sequencer and charging FRNT fees does not create a licensing obligation in New Zealand that we have not met.

Mainnet opening additionally requires the community vote in month 11.

13. Monthly running cost estimate

Year-one mainnet, RaaS-operated (Phase A). Low and high reflect the published and third-party ranges above; the provider figure is the largest unknown until we have quotes.

Item Low (US$/month) High (US$/month) Source / note
RaaS chain tier (sequencer, proposer, batcher, HA, explorer) 2,500 8,000 Conduit Pro is contact-for-pricing; third-party range $3k to $15k all-in
Sequencer revenue share to provider 5% of sequencer profit 5% of sequencer profit Conduit price sheet
Base settlement and data posting 50 500 Depends on batch cadence; Base txs about $0.05
RPC (Pro) 50 300 Conduit RPC Pro $50 base, overage $0.10 per 1M CU
Indexing 500 500 Conduit mainnet indexing
Self-run fallback full node + archive node (2 VMs, storage) 400 900 Cloud list prices
Monitoring, status page, alerting 50 150
Bug bounty reserve (amortised) 500 1,000 Reserve, paid only on valid reports
Infrastructure subtotal about 4,000 about 11,000
Engineering salaries (2.0 FTE + 0.5 contract, NZD converted at 0.60) 20,000 27,000 Section 10
All-in about 24,000 about 38,000

So the 18-month trigger reserve in section 12 is roughly US$430,000 to US$690,000, which is why the chain only makes sense past the US$1M raise mark. The one-off costs on top: audit and re-audit about US$80,000; testnet period about US$250/month plus salaries.

Self-hosted Phase B replaces the RaaS tier with roughly US$1,500 to US$3,000 per month of cloud (3 sequencer nodes, batcher, proposer, 2 RPC nodes, archive node) but requires the devops engineer full time; it is not cheaper in total until transaction volume makes the 5% revenue share material.

14. Risks

Risk Likelihood Impact Mitigation
CGT v2 not production-proven when we start Medium High Fallback to Orbit (section 1); decision point in month 1 with a named reference chain required
FRNT price volatility makes fees unpredictable High Medium 25% buffer, monthly review, minBaseFee floor, keeper sells FRNT to ETH continuously rather than in lumps
Operator-run sequencer is a single point of failure High (by design in Phase A) Medium HA cluster, forced inclusion from Base, published failover drills, Phase B self-host
Bridge bug loses user funds Medium Critical Application-layer bridge is new code (CGT v2): dedicated audit, bug bounty, bridged-value cap of US$250,000 for the first 90 days, pause switch held by the Safe
2-of-2 Safe: one lost key freezes upgrades and the liquidity controller Medium High Move to 2-of-3 with an independent signer before mainnet; hardware wallets; documented recovery
Base changes break L3 assumptions (base/base migration, hard-fork cadence of 6 per year) Medium Medium Pin client versions, test every Base fork on testnet first, keep the provider on retainer for upgrades
Regulatory: running a sequencer and selling gas could be a financial service in NZ Unknown High Legal opinion is a launch trigger (section 12, item 5)
Team of two cannot sustain on-call High Medium Provider SLA in Phase A; do not self-host until a third engineer or a paid on-call contract exists
Low usage: a chain nobody uses costs US$300k/year Medium Medium Launch only with a committed set of first applications (ledger, rewards distribution, research data registry); sunset rule: if monthly active addresses are under 500 for two consecutive quarters after month 18, the community votes on winding the chain down and bridging everything back to Base

15. What the chain is for (so the cost is justified)

First-party applications committed for mainnet:

  1. Public ledger on-chain: every treasury payment mirrored as an L3 event with the receipt hash, readable by the treasury page.
  2. Community rewards distribution: points-to-FRNT conversions settled on Frontier chain with near-zero fees.
  3. Research data registry: content-addressed records of published research briefs, prospecting targets and data sets, with FRNT-paid timestamping.
  4. Governance signalling for the votes the roadmap already promises (chain timing, treasury milestones).

If none of these needs the chain more than they need Base, the honest answer is to stay on Base, and this document should be revisited rather than executed.

Sources