Scaling
Bridges
SummaryValue LockedRisk summaryTechnologyPermissionsSmart contracts

L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our discord to suggest improvements!

PulseChain logoPulseChain

Bridge used to transfer assets from Ethereum to PulseChain. Transfers are validated by set of trusted Validators.
  • Total value locked
    $104.96 M1.36%
  • Destination
    PulseChain
  • Validated by
    Third Party
  • Type
    Token Bridge
    • Value Locked

    ...

    Risk summary

    Funds can be stolen if

    1. validators relay a fake message to a destination chain to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL),
    2. validators relay a fake message to Ethereum chain allowing a user to withdraw tokens from Ethereum escrow when equivalent amount of tokens has not been deposited and burned on destination chain (CRITICAL),
    3. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

    Funds can be frozen if

    1. validators don't relay messages between chains.

    Users can be censored if

    1. validators decide to not pass selected messages between chains (CRITICAL).
    Note: This project's overview requires more research and might not present accurate information. If you want to contribute you can edit the information on Github. Alternatively you contact the project team on Twitter and encourage them to contribute a PR.
    Technology

    Validation

    Note: This section requires more research and might not present accurate information.

    PulseChain Bridge stores a number of Validators which need to sign off every message coming from the PulseChain. Once quorum of signatures is reached, message (e.g. withdrawal request) can be relayed to a destination contract.

    • Users can be censored if validators decide to not pass selected messages between chains (CRITICAL).

    • Funds can be stolen if validators relay a fake message to a destination chain to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL).

    • Funds can be stolen if validators relay a fake message to Ethereum chain allowing a user to withdraw tokens from Ethereum escrow when equivalent amount of tokens has not been deposited and burned on destination chain (CRITICAL).

    • Funds can be frozen if validators don't relay messages between chains.

    Permissions

    The system uses the following set of permissioned addresses:

    Validators 0xf6ab…3FC00x1daD…bf8c0xd4Aa…8fbD0xfB18…35330xe158…beDa0x5ECf…D74E0xFE9a…dd2C0xe3B9…1F69

    Permissioned set of validators that can sign off any arbitrary message from PulseChain including withdrawal request. 5 / 8 signatures are required.

    Owner of Validators contract 0x3eA0…513f

    Owner of Validators contract keeping a list of current Validators. Can add/remove Validators.

    Upgradeability Owner of main bridge contract 0x13A9…7801

    Owner of the main bridge contract, able to upgrade the contract with no notice.

    Smart contracts

    The system consists of the following smart contracts:

    ForeignOmnibridge 0x1715…A10DImplementation (Upgradable)Admin

    The main Bridge contract and the escrow for the PulseChain bridge. It is used to deposit tokens to the bridge. This contract can store any token.

    ForeignAMB 0xd076…636cImplementation (Upgradable)Admin

    The Arbitrary Message Bridge receiving messages from the Foreign Chain. It is used for processing withdrawals from the bridge.

    BridgeValidators 0x2fa8…C95dImplementation (Upgradable)Admin

    Contract managing the list of trusted bridge Validators.

    WETHOmnibridgeRouter 0x8AC4…0f55

    The Auxiliary contract that handles wrapped tokens.

    Value Locked is calculated based on these smart contracts and tokens:

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

    If you find something wrong on this page you can submit an issue or edit the information