L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our discord to suggest improvements!

Aptos (LayerZero) logoAptos (LayerZero)

Aptos Bridge is built on top of LayerZero protocol and is a token bridge for transferring assets from Ethereum to Aptos. It leverages an oracle and relayer for cross-chain security for the protocol.
  • Total value locked
    $20.84 M2.21%
  • Destination
    Aptos
  • Validated by
    Third Party
  • Type
    Token Bridge
  • ...

    Tokens

    Choose token

    Bridged Tokens (Top 15)

    USD Coin (USDC)
    Tether USD (USDT)
    Wrapped Ether (WETH)
    Risk summary
    This project includes unverified contracts. (CRITICAL)
    Technology

    Principle of operation

    Aptos Bridge is a Token Bridge. It locks tokens in Ethereum escrow and mints tokens on Aptos.

    Oracles and Relayers

    Note: This section requires more research and might not present accurate information.

    Aptos Bridge is built on top of LayerZero protocol. LayerZero relies on Oracles to periodically submit source chain block hashes to the destination chain. Once block hash is submitted, Relayers can provide the merkle proof for the transfers. Token Bridge owner can withdraw all funds from the bridge escrow after placing the bridge in an emergency withdrawal mode that will allow them to transfer all tokens out after 1 week delay.

    • Users can be censored if oracles or relayers fail to facilitate the transfer (CRITICAL).

    • Funds can be stolen if oracles and relayers collude to submit fraudulent block hash and relay fraudulent transfer (CRITICAL).

    • Funds can be stolen if token bridge owner (currently EOA) enables emergency withdrawal and users do not exit with their funds within a week (CRITICAL).

    • Funds can be stolen if token bridge owner (currently EOA) sets WETH contract address to a malicious contract that will allow the owner to steal user's ETH (CRITICAL).

    Permissions

    The system uses the following set of permissioned addresses:

    Aptos Multisig 0x65bb…9705

    Bridge owner, can setup tokens, fees, WETH token address (potentially malicious). Can withdraw all the funds from the Escrow after unlocking emergency withdrawal with 1 week delay. This is a Gnosis Safe with 3 / 6 threshold.

    Used in:

    Project icon

    Those are the participants of the Aptos Multisig.

    LayerZero Relayer 0x902F…089E

    Contract authorized to relay messages and - as a result - withdraw funds from the bridge.

    Used in:

    Project icon
    Project icon
    LayerZero Relayer Admin owner 0x76F6…d6e5

    Can upgrade LayerZero relayer contract with no delay.

    Used in:

    Project icon
    LayerZero Oracle Admin owner 0x7B80…e6c8

    Can upgrade LayerZero oracle contract with no delay.

    Used in:

    Project icon
    LayerZero Multisig 0xCDa8…4C92

    The owner of Endpoint, UltraLightNode and Treasury contracts. Can switch to a new UltraLightNode for an Endpoint. Can switch proof library for an UltraLightNode and change Treasury. This is a Gnosis Safe with 2 / 5 threshold.

    Used in:

    Project icon
    Project icon

    Those are the participants of the LayerZero Multisig.

    Smart contracts
    Note: This section requires more research and might not present accurate information.

    The system consists of the following smart contracts on the host chain (Ethereum):

    TokenBridge 0x5000…d907

    Aptos Token Bridge. This contract stores the following tokens: USDC, USDT, WETH.

    The source code of some implementations is not verified on Etherscan.

    Proxy used in:

    Project icon
    Project icon

    The source code of some implementations is not verified on Etherscan.

    Proxy used in:

    Project icon
    Project icon
    Endpoint 0x66A7…d675

    LayerZero Ethereum Endpoint.

    Implementation used in:

    Project icon
    Project icon
    UltraLightNodeV2 0x4D73…78E2

    LayerZero UltraLight Node V2. Used by oracles to checkpoint source chain block hashes.

    Implementation used in:

    Project icon
    Project icon
    TreasuryV2 0x3773…e34d

    LayerZero Treasury.

    Implementation used in:

    Project icon
    LayerZero Proof Library 0x0724…df89

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

    • Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).

    Knowledge Nuggets