# \[Discussion\] A second, issuer-controlled verifier for cross-chain GHO on CCIP 2.0

**URL:** <https://governance.aave.com/t/discussion-a-second-issuer-controlled-verifier-for-cross-chain-gho-on-ccip-2-0/25771>\
**Category:** Governance\
**Created:** [October 4, 2026, 12:26pm UTC](https://governance.aave.com/t/discussion-a-second-issuer-controlled-verifier-for-cross-chain-gho-on-ccip-2-0/25771 "2026-10-04T12:26:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![anfossopablo](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@anfossopablo](https://governance.aave.com/u/anfossopablo)\
**Post date:** [October 4, 2026, 12:26pm UTC](https://governance.aave.com/t/discussion-a-second-issuer-controlled-verifier-for-cross-chain-gho-on-ccip-2-0/25771/1 "2026-10-04T12:26:31Z")

</div>

Hi everyone,

Cross-chain GHO runs on Chainlink CCIP: GHO is locked on Ethereum and minted through facilitators on other chains. CCIP 2.0, live since September 28, now lets a token pool require additional verifiers on top of Chainlink’s committee.

We built Countersign. Countersign is an issuer-operated Cross-Chain Verifier (CCV) for Chainlink CCIP 2.0 that runs as a CRE workflow, so there are no servers to operate. The token pool refuses to mint or release a large transfer until Countersign has independently re-checked it: the canonical OnRamp event, the cross-chain supply invariant (and Proof of Reserve when available), rolling outflow and per-sender limits, and a denylist. A guardian can hold a suspicious transfer for review, and a tighten-only circuit breaker freezes lanes if supply ever looks unbacked.

For GHO it can enforce the core invariant directly: GHO minted on remote chains never exceeds GHO locked on Ethereum, checked for every transfer before the mint, plus rolling outflow limits per lane.

Live on public testnets, including a transfer held and then released by a guardian:

- 2-minute demo: [https://youtu.be/FKoKNaHxgg0](https://youtu.be/FKoKNaHxgg0)
- Open-source code, 99 tests and every testnet transaction: [GitHub - allertrack/countersign: countersign · GitHub](https://github.com/allertrack/countersign)

We’d welcome feedback from the community and service providers on whether a testnet pilot on GHO’s lanes is worthwhile, and which thresholds and limits would make sense. Countersign only adds checks: it cannot move funds or loosen rate limits.

Pablo, Countersign