NODL token economy hardening (post L1 pool launch)

[Douglasacost]

Goal

Harden the NODL token economy after the Uniswap L1 pool is live. Follow-up to "Create Uniswap pool for NODL on Ethereum L1" — these items matter more once an L1 pool makes any L2 mint sellable on Ethereum within hours (L2→L1 bridge latency), but they are independent of pool creation itself.

Context (verified on-chain, 2026-08-10)

• The bridge is burn-and-mint with no escrow: total NODL = supply on Ethereum (0x6dd0E17ec6fE56c5f58a0Fe2Bb813B9b5cc25990) + supply on zkSync Era (0xBD4372e44c5eE654dd838304006E1f0f69983154).
• Current L2 minters: the L2 bridge, the Rewards contract (0xe629b208046f7a33de3a43931c9fe505a7ac3d36, oracle-signed quota-limited emissions), and the zkSync Safe itself (0x5e097AC1BCF81E7Ff2657045F72cAa6cF06486C9).
• The parachain is stopped — Rewards emissions are the only intended supply growth.
• Note: the Bridgehub cutover (other team) rotates the bridge minter roles; re-check the final minter set after it lands.

Checklist

• Revoke the zkSync Safe's direct MINTER_ROLE on L2 NODL (least privilege). The Safe keeps DEFAULT_ADMIN_ROLE, so minting remains possible via an explicit re-grant round-trip — but a single compromised signing session can no longer mint. Needs sign-off from the Safe signers on the added friction.
• Publish the emission policy: Rewards quota per period, who can change it, expected inflation schedule. Add alerts on quota changes and on authorizedOracle rotation.
• Harden the Rewards oracle key: storage (HSM/KMS), rotation procedure, documented blast radius (it authorizes mints up to quota per period).
• Supply-invariant monitoring: job tracking totalSupply(L1) + totalSupply(L2); alert if combined supply grows by anything other than Rewards emissions, or if L1 supply changes outside bridge finalizations. This is the tripwire for unauthorized minting.
• LP risk disclosure if community LPs are invited into the pool: burn-and-mint bridge model, admin powers, emission schedule.

Done when

• Safe mint role revoked (or explicitly decided against, with rationale recorded)
• Emission policy published; quota/oracle alerts live
• Supply-invariant monitor running and tested

[nighshift-labs]

This hardening checklist's one-network slice matches a checker I maintain: a public-data-only reconciliation of one token on one EVM network — claim-versus-observation (chain ID, address, symbol/decimals, owner/minter/paused surfaces, EIP-1967 admin slot, a bounded Transfer-event scan), pinned to a supplied block, with cross-chain supply, key management, bridge cutover, and role changes explicitly out of scope.

Synthetic sample shaped to this issue's zkSync Era NODL address (every observation is illustrative, not live): https://blossom.primal.net/c07b6587685b7b17f3efa9133c2e1fa1d8d1f2eb07cc7e770b60199ccfedc16a.json

A real run needs one network, one token address, the public claims/source packet, and a bounded block range over a permitted HTTPS RPC endpoint. No keys, no signing, no wallet access, no continuous monitoring.

Would a bounded zkSync-Era reconciliation of the L2 minting surface be useful, or is it already covered by the supply-invariant monitor you're tracking? If useful, one network + address + block range is all I need for a real read-only pass.