One owner, on the chain you trust. Control on every other.
A protocol on many chains ends up running a separate admin account on each one. Every one has its own address, its own nonces, and its own steps to act. Each extra place you act is another place to get phished, send the wrong payload, or lose access.
crossecute reduces that to one owner. The owner can be any address that can make a call: an EOA, a multisig, a DAO's governor, or any other contract. The actions it sends are carried to any destination chain and run there. You act once, on the chain you trust most, and the operation lands everywhere.
You pick which chain that is, and nothing in the protocol favors one. Every chain runs the same contracts, so any of them can be a home. The protocol calls each owner's cross-chain account a conduit. A conduit's home is the chain it was created on, chosen per conduit rather than once for everyone. Nothing is configured per conduit: once the chains are connected, the first message from a conduit's home creates its receiver on the destination, at the same address.
flowchart LR
owner(["Owner<br/>EOA, multisig, or any contract"]) --> home[("Conduit on its home chain")]
home -->|cross-chain message| a["Receiver · Chain A"]
home -->|cross-chain message| b["Receiver · Chain B"]
home -->|cross-chain message| n["Receiver · Chain N"]
Once every chain answers to one owner, the hard part is trusting what that owner approves. For a Safe, an operator builds a transaction with a script in one repo and submits it to the Safe in another. How does a signer know the thing in the queue is exactly what the script produced, and was not changed on the way? forge-attest closes that gap for Safe owners.
| Repo | What it does | Status |
|---|---|---|
| forge-attest | Proves a submitted Safe transaction is byte for byte the output of a specific Forge script at a pinned commit. It reproduces the script, derives the Safe tx hash three independent ways, and checks it against the live Safe queue. Handles single transactions, Transaction Builder batches, nested Safes, and one transaction per chain from a single config. --attest lets each owner sign and submit once the checks pass. Ships as a CLI, a GitHub Action, and a Claude Code plugin. Chain-agnostic. |
✅ v1.1.0 |
| forge-attest-example-safe-ops | A reference producer repo: deterministic Forge scripts that build a single Safe tx and a Transaction Builder batch, both verified by forge-attest. | ✅ Available |
| protocol | The cross-chain executor. An owner's conduit holds the same address on every chain, homed on whichever chain they created it on. The half on that home sends; the half on every other chain receives and runs what arrives, either on arrival or later against an approval. Covers conduit creation, the approval map, cancellation, and both message paths, with native bindings for LayerZero, CCIP, Hyperlane, Wormhole, and OP Stack (L1 ↔ L2 and L2 ↔ L2), plus layerzero-oft through an operator's own OFT. Send and receive follow ERC-7786. |
🚧 In progress |
The org also keeps forks of forge-std, openzeppelin-contracts, and openzeppelin-contracts-upgradeable, which protocol pins as submodules.
- Do not trust, verify. Every artifact can be rebuilt and checked by anyone. Provenance is worked out from the artifact, never asserted.
- One point of control. One owner instead of one per chain: fewer accounts, fewer nonces, fewer ways to be tricked.
- Any owner. The protocol authenticates an address, not a wallet type. An EOA, a Safe, a governor, or any other contract can own a conduit.
- The anchor is a choice, not a constant. Each conduit picks its home chain when it is created. Centralize where your trust already is.
- Composable, not monolithic. Each piece (provenance, execution, tooling) stands alone and is useful on its own.
Early. The verification layer is public and released as forge-attest v1.1.0. The protocol's EVM contracts are built and tested, but every message provider is so far tested against a mock, and nothing has crossed a real bridge yet. Issues and questions are welcome on any repo above.