Cross-Chain Messages

interface IMetalOutbox {
    /// Emitted for relayers and indexers; verification never trusts it.
    event MessageSent(
        uint256 indexed nonce,
        uint64 indexed destinationChainId,
        address indexed target,
        address sender,
        bytes payload
    );

    /// Queue a cross-chain message. Returns its sequential nonce.
    function send(uint64 destinationChainId, address target, bytes calldata payload)
        external
        returns (uint256 nonce);
}

leaf[nonce] = keccak256(abi.encode(
    metalChainId,        // source domain
    destinationChainId,  // destination domain
    nonce,
    msg.sender,          // authenticated Metal-side sender
    target,
    payload
))

interface IMetalInbox {
    event MessageExecuted(uint256 indexed nonce, address indexed target, address sender);

    function execute(
        bytes32 checkpointBlockHash,   // an accepted MetalLightClient checkpoint
        uint256 nonce,
        address sender,                // Metal-side sender
        address target,
        bytes calldata payload,
        uint256 leafCount,             // tree size at the checkpoint
        bytes32[32] calldata path      // sibling path for leaf `nonce`
    ) external;

    /// The Metal-side sender of the message currently executing;
    /// zero outside of an execute call.
    function metalSender() external view returns (address);

    function consumed(uint256 nonce) external view returns (bool);
}

contract MyReceiver {
    address immutable inbox;

    constructor(address inbox_) {
        inbox = inbox_;
    }

    function onMessage(uint256 value) external {
        require(msg.sender == inbox, "only inbox");
        address metalSender = IMetalInbox(msg.sender).metalSender();
        // authorize against metalSender ...
    }
}