Search

Search for projects by name or address

SummaryVolume and flowsDescriptionTop tokens by volumeTransfersUpdatesPermissionsSmart contracts

deBridge logo
deBridge

1 recent update

About

deBridge is a message bridge and lock-and-mint token bridge. Cross-chain submissions are authorized by ECDSA signatures from a fixed validator set (8-of-12 on Ethereum) verified onchain; all core contracts are upgradable by a deBridge multisig without...

    Last 24h volume
    $38.19 K
    Last 24h transfer count
    33
    Last 24h top path
    hyperevmethereum$31.75 K
    Last 24h avg. transfer time
    2m 13s
    Last 24h avg. transfer value
    $1.90 K
    Tokens by volume
    USDCSURGESWAP
    +6
    Transfer size
    Under $100
    $100-$1K
    $1K-$10K
    $10K-$100K
    Over $100K
    Transfer type distribution
    Lock & Mint

    About

    deBridge is a message bridge and lock-and-mint token bridge. Cross-chain submissions are authorized by ECDSA signatures from a fixed validator set (8-of-12 on Ethereum) verified onchain; all core contracts are upgradable by a deBridge multisig without...

    Top token

    USDC
    USDC
    Volume
    $31.75 K
    Transaction count
    2
    Volume and flows
    Description

    deBridge is a message bridge and lock-and-mint token bridge. Cross-chain submissions are authorized by ECDSA signatures from a fixed validator set (8-of-12 on Ethereum) verified onchain; all core contracts are upgradable by a deBridge multisig without delay.

    Architecture

    deBridge deploys a central DeBridgeGate contract on each supported chain. It combines an arbitrary message bridge and a lock-and-mint token bridge: on an asset’s native chain, tokens are locked in the gate escrow; on all other chains, the gate mints and burns deBridge-wrapped tokens (deTokens). Optional calldata attached to a transfer is executed by a dedicated CallProxy contract, which performs the call from its own address to isolate it from the gate’s balances. Asset listing on the native side is permissionless: sending any local ERC20 through the gate auto-registers it (with unlimited transfer caps and no elevated-confirmation threshold until the admin configures them).

    Message lifecycle

    A send() or sendMessage() call locks or burns the asset and emits a submission whose ID commits to the bridged asset, source and destination chain IDs, amount, receiver, a gate-wide nonce and — if calldata is attached — the execution fee, flags, fallback address, calldata hash and original sender. The protocol charges a flat native-token fee (currently 0.001 ETH on Ethereum) plus a variable fee (currently 10 bps).

    On the destination chain, claiming is permissionless, but depends on validator signatures: anyone can submit them for a submission ID to claim(), earning the optional execution fee as a relayer reward. Attached calldata is forwarded to the CallProxy together with the bridged funds.

    Crosschain validation

    deBridge validators observe source chains offchain and sign submission IDs with plain ECDSA keys. The SignatureVerifier on the destination chain — callable only by the gate — accepts a submission if at least minConfirmations of the registered validator addresses have signed (currently 8 of 12 on Ethereum) and every validator flagged as required has signed (currently none is flagged).

    Two additional rate limits exist in the code: transfers above a per-asset amount threshold require an elevated signature count, and a per-block circuit breaker raises the requirement once more than confirmationThreshold submissions are approved within one block. As currently configured on Ethereum, both elevated thresholds are set to 3 signatures — below the baseline quorum of 8 — so neither mechanism has any effect. Deploying a deToken for a new asset (deployNewAsset) is likewise permissionless but requires the same validator quorum over the asset’s metadata.

    Wrapped tokens (deTokens)

    deTokens are deployed on first use by the DeBridgeTokenDeployer (callable only by the gate) as beacon proxies at deterministic addresses. The beacon is the deployer contract itself: its admin can re-point the shared implementation of all deTokens on the chain in a single transaction that emits no event. Each deToken grants MINTER_ROLE to the gate and both DEFAULT_ADMIN_ROLE and PAUSER_ROLE to the configured deBridgeTokenAdmin (the deBridge multisig on Ethereum), which can therefore pause transfers of any deToken or grant additional minters — i.e. mint unbacked deTokens — without touching the bridge itself.

    Censorship and pausing

    The gate admin can block (and unblock) individual submission IDs, permanently preventing specific already-signed transfers from being claimed, and can toggle entire chains as supported senders or receivers. Pausing is asymmetric: the GOVMONITORING_ROLE can pause all sends, claims and deToken deployments unilaterally, while only the DEFAULT_ADMIN_ROLE can unpause (on Ethereum, both roles are held by the same multisig).

    Upgradeability and governance

    All core contracts are upgradeable by a 5/8 deBridge multisig, with no timelock or exit window. The same multisig holds the DEFAULT_ADMIN_ROLE on all of them, so without an upgrade it can already replace the SignatureVerifier (i.e. swap out the entire validation layer), change the validator set and signature thresholds, replace the CallProxy and token deployer, redirect fee withdrawal rights, and censor submissions. The gate also has a feeContractUpdater slot that can adjust the flat protocol fee automatically (unset on Ethereum).

    Monitoring

    deBridge provides an explorer for tracking crosschain transfers, and the gate emits dedicated MonitoringSendEvent/MonitoringClaimEvent events carrying the locked/minted totals as an offchain solvency-tracking aid. However, many security-relevant admin functions (replacing the signature verifier, changing signature thresholds or amount thresholds, re-pointing the deToken beacon implementation, setting the fee proxy or fee discounts) emit no events at all, so they can only be caught by storage diffing.

    Top tokens by volume
    Symbol
    Last 24h Volume
    Last 24h transfer count
    Last 24h avg. transfer time
    Last 24h avg. transfer value
    Transfers
    From
    To
    Timestamp
    Tokens
    Value
    Bridge
    Transfer time
    Chains
    Updates
    2026 September 01, 12:16 UTC
    High severity
    7changes

    Add more signature verification modes (incl delegation): https://disco.l2beat.com/diff/eth:0xcfa67cDc75FFaac55bbf92f012cC75f47f479c35/eth:0xFf09c2C917180cDDb5d217073dd774fAA4A47677

    Add more signature verification modes (incl delegation): https://disco.l2beat.com/diff/eth:0xcfa67cDc75FFaac55bbf92f012cC75f47f479c35/eth:0xFf09c2C917180cDDb5d217073dd774fAA4A47677

    contract DeBridgeIntentManager (eth:0xDDDDDDDdeB2E68Ee19832e356FCB5537124A9708) [debridge/DeBridgeIntentManager] {
    +++ description: Fills user-signed intents by creating DLN orders on their behalf: it pulls input tokens from users through the DeBridgeAllowanceHolder and forwards them into DlnSource in the same transaction, charging a variable fee that is not part of the user-signed intent.
    sourceHashes.1:
    - "0xab4d827474b8362b953864f2ccb0de7e02c8c7150914446ea11c4c3f64413967"
    + "0x8bc472a2f0e9dd05e3781fa6f0e5b4bedc8e395196df151a26af1120fa398c8c"
    values.$implementation:
    - "eth:0xcfa67cDc75FFaac55bbf92f012cC75f47f479c35"
    + "eth:0xFf09c2C917180cDDb5d217073dd774fAA4A47677"
    values.$pastUpgrades.2:
    + ["2026-08-31T18:05:47.000Z","0x42218e55e5eab2e3c79d608b6302fd5dec0750f4426a55ed69d8564ed4a8dfb8",["eth:0xFf09c2C917180cDDb5d217073dd774fAA4A47677"]]
    values.$upgradeCount:
    - 2
    + 3
    values.version:
    - "2.1.0"
    + "2.3.0"
    implementationNames.eth:0xcfa67cDc75FFaac55bbf92f012cC75f47f479c35:
    - "DeBridgeIntentManager"
    implementationNames.eth:0xFf09c2C917180cDDb5d217073dd774fAA4A47677:
    + "DeBridgeIntentManager"
    }
    2026 August 20, 12:51 UTC
    24changes

    Verified source code of 3 proxy admins and external call executor. The sources of two more contract were not identified

    Verified source code of 3 proxy admins and external call executor. The sources of two more contract were not identified

    New and verified contracts

    contract ProxyAdmin (eth:0x368Fa5E37EF1aCefF359Dc2E9DC7393C1CbCC4A3) [global/ProxyAdmin] {
    +++ description: None
    name:
    - ""
    + "ProxyAdmin"
    unverified:
    - true
    values.UPGRADE_INTERFACE_VERSION:
    + "5.0.0"
    implementationNames.eth:0x368Fa5E37EF1aCefF359Dc2E9DC7393C1CbCC4A3:
    - ""
    + "ProxyAdmin"
    template:
    + "global/ProxyAdmin"
    sourceHashes:
    + ["0x8fd8f837bb320bd2a7463c103bea2ff207b0969b5795f320a6c868858aa92074"]
    }
    contract ProxyAdmin (eth:0xaBAc0E0AB68FC34441b36015bB952cD8f378283F) [global/ProxyAdmin] {
    +++ description: None
    name:
    - ""
    + "ProxyAdmin"
    unverified:
    - true
    values.UPGRADE_INTERFACE_VERSION:
    + "5.0.0"
    implementationNames.eth:0xaBAc0E0AB68FC34441b36015bB952cD8f378283F:
    - ""
    + "ProxyAdmin"
    template:
    + "global/ProxyAdmin"
    sourceHashes:
    + ["0x8fd8f837bb320bd2a7463c103bea2ff207b0969b5795f320a6c868858aa92074"]
    }
    contract ExternalCallExecutor (eth:0xAE0361b1C3454b297129e01046057F1D294c7974) [N/A] {
    +++ description: The default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders.
    unverified:
    - true
    description:
    - "Unverified contract registered as the default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders."
    + "The default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders."
    values.ADAPTER_ROLE:
    + "0xdbeb657137b1822b3d5418bea6fd641226d964b4c3871ef23546db2622258871"
    values.DEFAULT_ADMIN_ROLE:
    + "0x0000000000000000000000000000000000000000000000000000000000000000"
    implementationNames.eth:0xAE0361b1C3454b297129e01046057F1D294c7974:
    - ""
    + "ExternalCallExecutor"
    sourceHashes:
    + ["0x6c5aae59f2a5722455f7f6b27b17e514a918ab56299c83ae29aed90c2f8863b0"]
    }
    contract ProxyAdmin (eth:0xb54CD1e74f232C6de444464C81f81D13E6978816) [global/ProxyAdmin] {
    +++ description: None
    name:
    - ""
    + "ProxyAdmin"
    unverified:
    - true
    values.UPGRADE_INTERFACE_VERSION:
    + "5.0.0"
    implementationNames.eth:0xb54CD1e74f232C6de444464C81f81D13E6978816:
    - ""
    + "ProxyAdmin"
    template:
    + "global/ProxyAdmin"
    sourceHashes:
    + ["0x8fd8f837bb320bd2a7463c103bea2ff207b0969b5795f320a6c868858aa92074"]
    }
    2026 August 18, 06:39 UTC
    High severity
    29changes

    Common theme: support for fee-on-transfer/rebasing tokens on the fulfillment path by measuring actual received amounts instead of requiring exact transfers. - DlnSource 1.7.1 - 1.8.0 (impl diff) - DlnDestination 1.7.0 - 1.7.1 (impl diff) - ExternalCallAdapter 1.1.0 - 1.2.0 (impl diff) - DeBridgeRouter 3.1.0 - 3.2.0 (impl diff) No significant permission or governance changes

    Common theme: support for fee-on-transfer/rebasing tokens on the fulfillment path by measuring actual received amounts instead of requiring exact transfers.

    No significant permission or governance changes

    contract ExternalCallAdapter (eth:0x61eF2e01E603aEB5Cd96F9eC9AE76cc6A68f6cF9) [debridge/ExternalCallAdapter] {
    +++ description: Escrow and dispatcher for external calls attached to DLN orders: it receives the taker's funds of orders that carry calldata and releases them when the calldata is executed by the registered executor, or refunds the order authority on cancellation.
    sourceHashes.1:
    - "0x9e1d6978ce2fd4ad04aa5969d3bcef97fd54b2ded7c0d62599131196aec314dc"
    + "0x18bbebb819a937958472cbe9848d10adb1983dbffea723e7ba5e79e2ac6a50f2"
    values.$implementation:
    - "eth:0x7EA200f06c17cB9f64A3c8973a76DD8359fd68FA"
    + "eth:0xE143DbAEC892cEf2Af836dB49870A0Bcf9d5E6A1"
    values.$pastUpgrades.3:
    + ["2026-08-17T10:20:35.000Z","0x30e7e8dac55cb6f8ac7b7cc81c9132f01acb5fbb87ed1f44b568183518670fbb",["eth:0xE143DbAEC892cEf2Af836dB49870A0Bcf9d5E6A1"]]
    values.$upgradeCount:
    - 3
    + 4
    values.version:
    - "1.1.0"
    + "1.2.0"
    implementationNames.eth:0x7EA200f06c17cB9f64A3c8973a76DD8359fd68FA:
    - "DlnExternalCallAdapter"
    implementationNames.eth:0xE143DbAEC892cEf2Af836dB49870A0Bcf9d5E6A1:
    + "DlnExternalCallAdapter"
    }
    contract DeBridgeRouter (eth:0x663DC15D3C1aC63ff12E45Ab68FeA3F0a883C251) [debridge/DeBridgeRouter] {
    +++ description: Optional periphery router that can swap input tokens via whitelisted DEX routers and forward the proceeds into the DLN contracts (order creation, or order fulfillment on the hardcoded DlnDestination via fillCrossChain) in a single transaction. It does not custody funds across transactions and is not part of the DLN critical path.
    sourceHashes.1:
    - "0xfbd0e32e74cd0871ed9aaf242684ccae1423b67493f683b6c31d4282d6813a6a"
    + "0xbb3368874361b195a217b8488d3a15b0b0f5a6e5a1189b88964a97715889bbc8"
    values.$implementation:
    - "eth:0x3c857eD51c8a2747EE8c6F30EdDA5ea0D487CC64"
    + "eth:0xCe56012E880851baa234cD092aF516A0fcA9CFe3"
    values.$pastUpgrades.10:
    + ["2026-08-17T10:20:35.000Z","0x30e7e8dac55cb6f8ac7b7cc81c9132f01acb5fbb87ed1f44b568183518670fbb",["eth:0xCe56012E880851baa234cD092aF516A0fcA9CFe3"]]
    values.$upgradeCount:
    - 10
    + 11
    values.version:
    - 310
    + 320
    values.dlnDestination:
    + "eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f"
    implementationNames.eth:0x3c857eD51c8a2747EE8c6F30EdDA5ea0D487CC64:
    - "DeBridgeRouter"
    implementationNames.eth:0xCe56012E880851baa234cD092aF516A0fcA9CFe3:
    + "DeBridgeRouter"
    }
    contract DlnDestination (eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f) [debridge/DlnDestination] {
    +++ description: Destination side of the deBridge Liquidity Network (DLN) intent protocol: takers fulfill orders here permissionlessly by paying the 'take' amount, which is forwarded to the order recipient in the same transaction (this contract holds no user funds). The taker then sends an unlock message back to the source chain's DlnSource through the deBridge messaging protocol to claim the escrowed maker funds.
    sourceHashes.1:
    - "0x925d0cfe1e1388a72765060d6905fa5bfd29e5a50bf4dcd11c2747a9d3097825"
    + "0xcca702480efa62cd07a9ea9b50d25bd2fec07bdb974ed969b52461235e056c6b"
    values.$implementation:
    - "eth:0xE540eb6BfEE129d28d47E26Ad33a138d66FD78f5"
    + "eth:0xD9b4f9CacFFB59F2B982ad3c45096e3AA4B4020e"
    values.$pastUpgrades.5:
    + ["2026-08-17T10:20:35.000Z","0x30e7e8dac55cb6f8ac7b7cc81c9132f01acb5fbb87ed1f44b568183518670fbb",["eth:0xD9b4f9CacFFB59F2B982ad3c45096e3AA4B4020e"]]
    values.$upgradeCount:
    - 5
    + 6
    values.version:
    - "1.7.0"
    + "1.7.1"
    implementationNames.eth:0xE540eb6BfEE129d28d47E26Ad33a138d66FD78f5:
    - "DlnDestination"
    implementationNames.eth:0xD9b4f9CacFFB59F2B982ad3c45096e3AA4B4020e:
    + "DlnDestination"
    }
    contract DlnSource (eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66) [debridge/DlnSource] {
    +++ description: Source-side escrow of the deBridge Liquidity Network (DLN) intent protocol: users lock the 'give' funds of a cross-chain order directly in this contract. Funds are released to the taker (claimUnlock) or refunded to the maker (claimCancel) only on a message from the DlnDestination configured for the order's destination chain, authenticated via the CallProxy of the deBridge messaging protocol (i.e. ultimately by deBridge validator signatures).
    sourceHashes.1:
    - "0x1ee6b36758f7c1cb71e4ed6d4e731d42a09413cdfeaf71a16c0554633c6047c9"
    + "0x1a65dd672c1d690b7748bf1c367c91be2553be1610e4efa604279e7855978cb5"
    values.$implementation:
    - "eth:0x322B481088143d9Ff74e4169Fb7f12F7808690DF"
    + "eth:0x2b426a0Ac391490e88d15B304436e7a84Df78611"
    values.$pastUpgrades.5:
    + ["2026-08-17T10:20:35.000Z","0x30e7e8dac55cb6f8ac7b7cc81c9132f01acb5fbb87ed1f44b568183518670fbb",["eth:0x2b426a0Ac391490e88d15B304436e7a84Df78611"]]
    values.$upgradeCount:
    - 5
    + 6
    values.version:
    - "1.7.1"
    + "1.8.0"
    implementationNames.eth:0x322B481088143d9Ff74e4169Fb7f12F7808690DF:
    - "DlnSource"
    implementationNames.eth:0x2b426a0Ac391490e88d15B304436e7a84Df78611:
    + "DlnSource"
    }
    2026 August 14, 11:18 UTC
    High severity
    61changes

    Full rediscovery of deBridge on Ethereum for the interop research: extended the discovery from the DeBridgeGate messaging/token bridge to the complete deployed stack including DLN (DlnSource/DlnDestination), the external call contracts (ExternalCallAdapter, unverified ExternalCallExecutor), the periphery DeBridgeRouter, and the new intent-manager stack (DeBridgeIntentManager, DeBridgeAllowanceHolder, IntentManagerValidator). Added debridge/ templates with descriptions and dynamic permissions (validator set, admin roles, fee collector, governance cancel role, allowance holder spender role). Notable: the intent-manager stack is administered and upgradeable by a single EOA (0x844e5b...) via unverified ProxyAdmins, unlike the multisig-governed core.

    Full rediscovery of deBridge on Ethereum for the interop research: extended the discovery from the DeBridgeGate messaging/token bridge to the complete deployed stack including DLN (DlnSource/DlnDestination), the external call contracts (ExternalCallAdapter, unverified ExternalCallExecutor), the periphery DeBridgeRouter, and the new intent-manager stack (DeBridgeIntentManager, DeBridgeAllowanceHolder, IntentManagerValidator). Added debridge/* templates with descriptions and dynamic permissions (validator set, admin roles, fee collector, governance cancel role, allowance holder spender role). Notable: the intent-manager stack is administered and upgradeable by a single EOA (0x844e5b…) via unverified ProxyAdmins, unlike the multisig-governed core.

    EOA (eth:0x391276932b5105C2DB8eE928dfd8872564d6d246) {
    +++ description: None
    receivedPermissions.1:
    + {"permission":"interact","from":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","description":"withdraw accumulated DLN protocol fees (not user principal) to itself.","role":".feeCollectorAC"}
    }
    contract Admin Multisig (eth:0x6bec1faF33183e1Bc316984202eCc09d46AC92D5) [GnosisSafe] {
    +++ description: None
    receivedPermissions.9:
    + {"permission":"interact","from":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","description":"set the trusted DlnSource address (message receiver) for each supported chain, replace the external call adapter that custodies funds of orders with attached calldata, unpause the contract, and grant/revoke all roles.","role":".defaultAdminAC"}
    receivedPermissions.10:
    + {"permission":"interact","from":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","description":"set the trusted DlnDestination address for each supported chain (a malicious address there can drain all escrowed order funds via forged unlock messages), change DLN fees without upper bound, unpause the contract, and grant/revoke all roles.","role":".defaultAdminAC"}
    }
    contract DlnDestination (eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f) [debridge/DlnDestination] {
    +++ description: Destination side of the deBridge Liquidity Network (DLN) intent protocol: takers fulfill orders here permissionlessly by paying the 'take' amount, which is forwarded to the order recipient in the same transaction (this contract holds no user funds). The taker then sends an unlock message back to the source chain's DlnSource through the deBridge messaging protocol to claim the escrowed maker funds.
    sourceHashes.1:
    - "0x5ed9ca82d8103a5414cd152cef8ee9140f15a2e0e8dc0a36b7074ccb95098566"
    + "0x925d0cfe1e1388a72765060d6905fa5bfd29e5a50bf4dcd11c2747a9d3097825"
    values.$implementation:
    - "eth:0x33B72F60F2CEB7BDb64873Ac10015a35bed81717"
    + "eth:0xE540eb6BfEE129d28d47E26Ad33a138d66FD78f5"
    values.$pastUpgrades.4:
    + ["2026-02-13T12:08:35.000Z","0xf187915dcb7b435138135f96d4a9bf6f606255d5247b00f0282afd2516bc02d2",["eth:0xE540eb6BfEE129d28d47E26Ad33a138d66FD78f5"]]
    values.$upgradeCount:
    - 4
    + 5
    values.chainEngines:
    - [0,0,0,0,0]
    values.dlnSourceAddresses:
    - ["0x","0x","0x","0x","0x"]
    +++ description: Maximum number of orders that can be unlocked in a single batch message to an EVM source chain.
    values.maxOrderCountPerBatchEvmUnlock:
    - 10
    + 50
    values.version:
    - "1.3.0"
    + "1.7.0"
    values.accessControl:
    + {"DEFAULT_ADMIN_ROLE":{"adminRole":"DEFAULT_ADMIN_ROLE","members":["eth:0x6bec1faF33183e1Bc316984202eCc09d46AC92D5"]},"GOVERNANCE_DELEGATED_ORDER_CANCEL_ROLE":{"adminRole":"DEFAULT_ADMIN_ROLE","members":["eth:0x0746e7e4d15F30885616B4ac3D274393354E80c0"]}}
    values.defaultAdminAC:
    + ["eth:0x6bec1faF33183e1Bc316984202eCc09d46AC92D5"]
    +++ description: The admin-configured DlnSource address per source chain ID, used as the receiver of outbound unlock/cancel messages.
    values.dlnSourceAddressesMap:
    + {"10":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","56":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","137":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","250":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","4663":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","8453":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","42161":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","43114":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","59144":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","7565164":"0x0d0720fe448de59d8811e24d6df917dc8d0d98b392ddf4dd2b622a747a60fded","100000001":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000002":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000003":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000004":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000005":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000006":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000008":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000009":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000010":"eth:0xA13771CAbd2e44dcA8DeA846cc954D1FbAc0623b","100000012":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000013":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000014":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000015":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000017":"eth:0xA13771CAbd2e44dcA8DeA846cc954D1FbAc0623b","100000019":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000020":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000021":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000022":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000023":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000024":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000025":"eth:0xA13771CAbd2e44dcA8DeA846cc954D1FbAc0623b","100000026":"eth:0xE6f924E3C42350684aF70F798c3cA2533A4c5Bd0","100000027":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000028":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000029":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000030":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66","100000031":"eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66"}
    values.govCancelAC:
    + ["eth:0x0746e7e4d15F30885616B4ac3D274393354E80c0"]
    values.GOVERNANCE_DELEGATED_ORDER_CANCEL_ROLE:
    + "0x01bd451848033b83db2d5c21b44e19dc2cf0e3067ae17fafefe1ac665572eeb3"
    values.subscriptionId:
    + 0
    errors:
    - {"chainEngines":"Processing error occurred.","dlnSourceAddresses":"Processing error occurred."}
    implementationNames.eth:0x33B72F60F2CEB7BDb64873Ac10015a35bed81717:
    - "DlnDestination"
    implementationNames.eth:0xE540eb6BfEE129d28d47E26Ad33a138d66FD78f5:
    + "DlnDestination"
    template:
    + "debridge/DlnDestination"
    description:
    + "Destination side of the deBridge Liquidity Network (DLN) intent protocol: takers fulfill orders here permissionlessly by paying the 'take' amount, which is forwarded to the order recipient in the same transaction (this contract holds no user funds). The taker then sends an unlock message back to the source chain's DlnSource through the deBridge messaging protocol to claim the escrowed maker funds."
    fieldMeta:
    + {"dlnSourceAddressesMap":{"description":"The admin-configured DlnSource address per source chain ID, used as the receiver of outbound unlock/cancel messages."},"externalCallAdapter":{"description":"Admin-settable contract that receives the taker's funds of orders carrying attached calldata before executing it (a malicious adapter could steal the funds of every such order)."},"maxOrderCountPerBatchEvmUnlock":{"description":"Maximum number of orders that can be unlocked in a single batch message to an EVM source chain."}}
    category:
    + {"name":"Local Infrastructure","priority":5}
    }
    contract DlnSource (eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66) [debridge/DlnSource] {
    +++ description: Source-side escrow of the deBridge Liquidity Network (DLN) intent protocol: users lock the 'give' funds of a cross-chain order directly in this contract. Funds are released to the taker (claimUnlock) or refunded to the maker (claimCancel) only on a message from the DlnDestination configured for the order's destination chain, authenticated via the CallProxy of the deBridge messaging protocol (i.e. ultimately by deBridge validator signatures).
    sourceHashes.1:
    - "0x9523aef2a126e91098e5c19a00872b86dc7fee8ba257f2015672763d85b2b683"
    + "0x1ee6b36758f7c1cb71e4ed6d4e731d42a09413cdfeaf71a16c0554633c6047c9"
    values.$implementation:
    - "eth:0xbF20cB9614a0059bBe4b599d1D04358aFe31eDfb"
    + "eth:0x322B481088143d9Ff74e4169Fb7f12F7808690DF"
    values.$pastUpgrades.3:
    + ["2025-09-15T11:47:11.000Z","0xf1d50e3b14cf974394d925c71087896c185c14c9e79506744a9fd57d5f2aa738",["eth:0xe13a85137f8752AbE4c5A614Dc3BaF396b00308D"]]
    values.$pastUpgrades.4:
    + ["2025-12-08T14:40:11.000Z","0x25b20353a5814918c4c569e1f9e8fede74138c9b7ab2043428a60f1c632d0ce6",["eth:0x322B481088143d9Ff74e4169Fb7f12F7808690DF"]]
    values.$upgradeCount:
    - 3
    + 5
    values.chainEngines:
    - [0,0,0,0,0]
    values.dlnDestinationAddresses:
    - ["0x","0x","0x","0x","0x"]
    values.version:
    - "1.5.0"
    + "1.7.1"
    values.accessControl:
    + {"DEFAULT_ADMIN_ROLE":{"adminRole":"DEFAULT_ADMIN_ROLE","members":["eth:0x6bec1faF33183e1Bc316984202eCc09d46AC92D5"]},"FEE_COLLECTOR_ROLE":{"adminRole":"DEFAULT_ADMIN_ROLE","members":["eth:0x391276932b5105C2DB8eE928dfd8872564d6d246"]}}
    values.defaultAdminAC:
    + ["eth:0x6bec1faF33183e1Bc316984202eCc09d46AC92D5"]
    +++ description: The admin-configured DlnDestination address per destination chain ID. Messages authenticated as coming from these addresses can unlock or refund all escrowed order funds.
    values.dlnDestinationAddressesMap:
    + {"10":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","56":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","137":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","250":"0x","4663":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","8453":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","42161":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","43114":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","59144":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","7565164":"0xa192b7f8b3eddc1e930a8e141564bb0ddc9d23f607cf13fd3a9fc15a638ed033","100000001":"0x","100000002":"0x","100000003":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000004":"0x","100000005":"0x","100000006":"0x","100000008":"0x","100000009":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000010":"0x","100000012":"0x","100000013":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000014":"0x","100000015":"0x","100000017":"0x","100000019":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000020":"0x","100000021":"0x","100000022":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000023":"0x","100000024":"0x","100000025":"0x","100000026":"eth:0xe8E2948B1E24E05C017aca0dCe44630595c464eb","100000027":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000028":"0x","100000029":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000030":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f","100000031":"eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f"}
    values.feeCollectorAC:
    + ["eth:0x391276932b5105C2DB8eE928dfd8872564d6d246"]
    values.intentManager:
    + "eth:0x0000000000000000000000000000000000000000"
    +++ description: Immutable allowlist contract: addresses it validates can create orders with custom or zero protocol fees (createSaltedOrderForIntent).
    values.intentManagerRights:
    + "eth:0x4247c6f71407359E4C8D29787E98D752F264CD4b"
    errors:
    - {"chainEngines":"Processing error occurred.","dlnDestinationAddresses":"Processing error occurred."}
    implementationNames.eth:0xbF20cB9614a0059bBe4b599d1D04358aFe31eDfb:
    - "DlnSource"
    implementationNames.eth:0x322B481088143d9Ff74e4169Fb7f12F7808690DF:
    + "DlnSource"
    template:
    + "debridge/DlnSource"
    description:
    + "Source-side escrow of the deBridge Liquidity Network (DLN) intent protocol: users lock the 'give' funds of a cross-chain order directly in this contract. Funds are released to the taker (claimUnlock) or refunded to the maker (claimCancel) only on a message from the DlnDestination configured for the order's destination chain, authenticated via the CallProxy of the deBridge messaging protocol (i.e. ultimately by deBridge validator signatures)."
    fieldMeta:
    + {"dlnDestinationAddressesMap":{"description":"The admin-configured DlnDestination address per destination chain ID. Messages authenticated as coming from these addresses can unlock or refund all escrowed order funds."},"globalFixedNativeFee":{"description":"Flat protocol fee in native tokens charged per order (refunded if the order is cancelled)."},"globalTransferFeeBps":{"description":"Variable protocol fee in basis points deducted from the order's give amount (no upper bound check; admin changes apply to new orders immediately)."},"intentManagerRights":{"description":"Immutable allowlist contract: addresses it validates can create orders with custom or zero protocol fees (createSaltedOrderForIntent)."}}
    category:
    + {"name":"Local Infrastructure","priority":5}
    }
    + Status: CREATED
    EOA (eth:0x0746e7e4d15F30885616B4ac3D274393354E80c0)
    +++ description: None
    + Status: CREATED
    contract (eth:0x368Fa5E37EF1aCefF359Dc2E9DC7393C1CbCC4A3) [N/A]
    +++ description: None
    + Status: CREATED
    contract IntentManagerValidator (eth:0x4247c6f71407359E4C8D29787E98D752F264CD4b) [debridge/IntentManagerValidator]
    +++ description: Immutable allowlist contract referenced by DlnSource: addresses holding the INTENT_MANAGER_ROLE can create DLN orders with custom or zero protocol fees. It grants no access to existing funds.
    + Status: CREATED
    contract (eth:0x6D83EAEb957986FEA14Ff0E88AF23736598e22cc) [N/A]
    +++ description: Unverified proxy referenced as the feeTreasury of the DeBridgeIntentManager.
    + Status: CREATED
    contract (eth:0xaBAc0E0AB68FC34441b36015bB952cD8f378283F) [N/A]
    +++ description: None
    + Status: CREATED
    contract (eth:0xb54CD1e74f232C6de444464C81f81D13E6978816) [N/A]
    +++ description: None
    + Status: CREATED
    contract (eth:0xd2a4cA9DA7B84c16B888df340d96a5a92aA44F07) [N/A]
    +++ description: Unverified proxy holding the INTENT_MANAGER_ROLE on the IntentManagerValidator, allowing it to create DLN orders with custom or zero protocol fees.
    + Status: CREATED
    contract DeBridgeAllowanceHolder (eth:0xddddddddd4B6472c5002F95610b194D1161223d0) [debridge/DeBridgeAllowanceHolder]
    +++ description: Immutable allowance sink of the deBridge intent system: users approve this contract (directly or as Permit2 spender) so that the upgradeable executor contracts never hold approvals themselves. Its transfer functions carry no intent-level checks: any ALLOWED_SPENDER_ROLE holder can move any approved token from any approver to any recipient.
    + Status: CREATED
    contract DeBridgeIntentManager (eth:0xDDDDDDDdeB2E68Ee19832e356FCB5537124A9708) [debridge/DeBridgeIntentManager]
    +++ description: Fills user-signed intents by creating DLN orders on their behalf: it pulls input tokens from users through the DeBridgeAllowanceHolder (Permit2 or direct approvals) and forwards them into DlnSource in the same transaction, charging a variable fee that is NOT part of the user-signed intent. It is non-custodial in steady state. Note that the EIP-712 signature users sign covers only an opaque intent hash, and fills are permissionless unless the intent restricts senders.

    New and verified contracts

    + Status: CREATED
    contract ExternalCallAdapter (eth:0x61eF2e01E603aEB5Cd96F9eC9AE76cc6A68f6cF9) [debridge/ExternalCallAdapter]
    +++ description: Escrow and dispatcher for external calls attached to DLN orders: it receives the taker's funds of orders that carry calldata and releases them when the calldata is executed by the registered executor, or refunds the order authority on cancellation.
    + Status: CREATED
    contract DeBridgeRouter (eth:0x663DC15D3C1aC63ff12E45Ab68FeA3F0a883C251) [debridge/DeBridgeRouter]
    +++ description: Optional periphery router that can swap input tokens via whitelisted DEX routers and forward the proceeds into the DLN contracts in a single transaction. It does not custody funds across transactions and is not part of the DLN critical path.
    + Status: CREATED
    contract ProxyAdmin (eth:0xA7b88A746FA457578D5abd6234471f07D895F46b) [global/ProxyAdmin]
    +++ description: None
    + Status: CREATED
    contract ExternalCallExecutor (eth:0xAE0361b1C3454b297129e01046057F1D294c7974) [N/A]
    +++ description: Unverified contract registered as the default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders.
    + Status: CREATED
    contract ProxyAdmin (eth:0xC86ab72dc6da7eF91a96650f3BC23125cD997130) [global/ProxyAdmin]
    +++ description: None
    + Status: CREATED
    contract DlnDestination (eth:0xE7351Fd770A37282b91D153Ee690B63579D6dd7f) [N/A]
    +++ description: None
    + Status: CREATED
    contract DlnSource (eth:0xeF4fB24aD0916217251F553c0596F8Edc630EB66) [N/A]
    +++ description: None
    2025 July 21, 10:11 UTC
    High severity
    11changes

    SimpleFeeProxy upgraded: - flash loans removed - AMB function added (sends only message, no tokens) - treasury deprecated, fees can now be removed by a permissioned actor

    SimpleFeeProxy upgraded:

    • flash loans removed
    • AMB function added (sends only message, no tokens)
    • treasury deprecated, fees can now be removed by a permissioned actor
    - Status: DELETED
    contract GnosisSafe (0xa0D6062Be29710c666aE850395Ac1A2AeCd14885)
    +++ description: None
    contract SimpleFeeProxy (0xC2bAC0DB5B18B0c3225581Ba14BD0B448c623636) {
    +++ description: None
    sourceHashes.1:
    - "0xc18d3818f9e809ced3dcce60fbe4287220ce2fced4f6c66711de5e704738bb9a"
    + "0x90a1adff0012e17a22d9eb35cecd932a71923919b443758b02b2c43ad666a352"
    values.$implementation:
    - "eth:0x37a52ddb753c924f8C914de65ef00b5210Caa83C"
    + "eth:0xa1cc7E623423169e1C10e6e5CC8Ae6f1d11042DE"
    values.$pastUpgrades.2:
    + ["2025-07-16T10:55:35.000Z","0x2891ca2643f9cb857b006952744b633088f22b57a8a04495abec7b79a500f1e3",["eth:0xa1cc7E623423169e1C10e6e5CC8Ae6f1d11042DE"]]
    values.$upgradeCount:
    - 2
    + 3
    values.getChainId:
    - 1
    values.treasury:
    - "eth:0xa0D6062Be29710c666aE850395Ac1A2AeCd14885"
    values.version:
    - 400
    + 410
    values.FEE_COLLECTOR_ROLE:
    + "0x2dca0f5ce7e75a4b43fe2b0d6f5d0b7a2bf92ecf89f8f0aa17b8308b67038821"
    implementationNames.eth:0x37a52ddb753c924f8C914de65ef00b5210Caa83C:
    - "SimpleFeeProxy"
    implementationNames.eth:0xa1cc7E623423169e1C10e6e5CC8Ae6f1d11042DE:
    + "SimpleFeeProxy"
    }
    Permissions

    Ethereum

    Actors:

    Admin Multisig0x6bec…92D5

    A Multisig with 5/8 threshold.

    • Can upgrade with no delay
      • DeBridgeGate
      • ExternalCallAdapter
      • DeBridgeRouter
      • DeBridgeTokenDeployer
      • CallProxy
      • SignatureVerifier
      • SimpleFeeProxy
      • DlnDestination
      • DlnSource
    • Can interact with DeBridgeGate
      • pause the DeBridgeGate, stopping all sends, claims and deToken deployments on this chain (only the admin can unpause)
      • replace the SignatureVerifier (and with it the entire validation layer of the deBridge messaging protocol), the CallProxy and the deToken deployer, censor individual submissions (blockSubmission), toggle supported chains, set all fees and per-address fee discounts, designate the fee withdrawal contract, unpause the gate, and grant/revoke all roles. Most of these setters emit no events
    • Can interact with ExternalCallAdapter
      • replace the executor contract that handles external calldata of DLN orders and pause the adapter
    • Can interact with DeBridgeRouter
      • manage the whitelist of swap routers and forwarding targets this contract may call with arbitrary calldata (and grant infinite token approvals to), set the service fee and fee treasury, and sweep any funds held by the router
    • Can interact with DeBridgeTokenDeployer
      • administer all deployed deTokens: pause their transfers and grant/revoke minter rights, including the ability to grant itself the right to mint unbacked deTokens
      • replace the implementation of all deTokens at once (this contract acts as their beacon), change the admin assigned to newly deployed deTokens, and override deToken names/symbols. None of these setters emit events
    • Can interact with CallProxy
      • grant and revoke the DEBRIDGE_GATE_ROLE that authorizes contracts to execute arbitrary external calls through the CallProxy
    • Can interact with SignatureVerifier
      • add and remove deBridge validators (oracles), change all signature thresholds (quorum must remain a majority of the oracle set), and re-point the gate contract allowed to request verification. Threshold changes emit no events
    • Can interact with SimpleFeeProxy
      • grant/revoke the FEE_COLLECTOR_ROLE that receives all deBridge protocol fees, pause fee withdrawals, and change the referenced gate contract
    • Can interact with DlnDestination
      • set the trusted DlnSource address (message receiver) for each supported chain, replace the external call adapter that custodies funds of orders with attached calldata, unpause the contract, and grant/revoke all roles
    • Can interact with DlnSource
      • set the trusted DlnDestination address for each supported chain (a malicious address there can drain all escrowed order funds via forged unlock messages), change DLN fees without upper bound, unpause the contract, and grant/revoke all roles

    Participants (8):

    0xbA7c…09B50xC351…8c2D0xD4Aa…dA2C0x874B…c6E10xE966…56B70x6f57…2FBD0xd725…e5440x24C0…7c96
    DeBridgeIntentManager0xDDDD…9708

    Fills user-signed intents by creating DLN orders on their behalf: it pulls input tokens from users through the DeBridgeAllowanceHolder and forwards them into DlnSource in the same transaction, charging a variable fee that is not part of the user-signed intent.

    • Can interact with DeBridgeAllowanceHolder
      • unconditionally transfer any amount of any token from any user who approved the DeBridgeAllowanceHolder (directly or via Permit2) to any recipient, and make arbitrary calls from its address
    EOA 10x0746…80c0
    • Can interact with DlnDestination
      • force-cancel any not-yet-fulfilled order that has a cancel beneficiary set by its maker (refunds can only go to that maker-designated address)
    12 EOAs
    EOA 2EOA 4EOA 5EOA 6EOA 7EOA 8EOA 9EOA 10EOA 11EOA 12EOA 13EOA 14
    • Can interact with SignatureVerifier
      • sign cross-chain submissions as a deBridge validator. A quorum of these signers can authorize arbitrary messages, mint deTokens and unlock collateral from the deBridge gate on this chain
    EOA 30x3912…d246
    • Can interact with SimpleFeeProxy
      • withdraw all protocol fees accrued in the DeBridgeGate to itself
    • Can interact with DlnSource
      • withdraw accumulated DLN protocol fees (not user principal) to itself
    EOA 150x844e…6444
    • Can upgrade with no delay
      • DeBridgeIntentManager
    • Can interact with DeBridgeAllowanceHolder
      • grant and revoke the ALLOWED_SPENDER_ROLE, i.e. authorize any address (including itself) to spend all outstanding user approvals of the deBridge intent system
    • Can interact with DeBridgeIntentManager
      • set intent fill fees up to 100% with immediate effect (fees are not part of the user-signed intent), manage the trusted solver set, sweep funds held by the contract, and grant/revoke all roles
    EOA 160xbda4…39e5
    • Can interact with IntentManagerValidator
      • grant and revoke the INTENT_MANAGER_ROLE that allows creating DLN orders with custom or zero protocol fees
    EOA 170xd6dF…C1EC
    • Can upgrade with no delay
    Smart contracts
    A diagram of the smart contract architecture
    A diagram of the smart contract architecture

    Ethereum

    DeBridgeGate0x43dE…98aAImplementation (Upgradable)Admin

    Central hub of the deBridge messaging protocol on this chain: it emits cross-chain submissions (asset transfers and/or arbitrary messages), locks and releases native assets, mints and burns deBridge-wrapped assets (deTokens), and executes claimed submissions after their validator signatures are checked by the SignatureVerifier. Claiming is permissionless: anyone can execute a submission that carries enough validator signatures.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
      • govMonitoring: Admin Multisig
    Can be upgraded by:
    Admin Multisig with no delay
    DeBridgeTokenDeployer0x8244…a464Implementation (Upgradable)Admin

    Deploys deBridge-wrapped token (deToken) contracts when an asset is bridged to this chain for the first time (callable only by the DeBridgeGate). All deTokens are beacon proxies whose beacon is this contract itself, so its tokenImplementation applies to every deToken on this chain at once.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • deBridgeTokenAdmin: Admin Multisig
      • defaultAdmin: Admin Multisig
    Can be upgraded by:
    Admin Multisig with no delay
    CallProxy0x8a0C…a824Implementation (Upgradable)Admin

    Sandbox that executes arbitrary calldata attached to claimed cross-chain submissions on behalf of the DeBridgeGate. Calls are performed from this contract’s address with attacker-choosable target and data, so external contracts must never trust it as a caller; it isolates such calls from the gate’s balances.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
    Can be upgraded by:
    Admin Multisig with no delay
    SignatureVerifier0x949b…8A8cImplementation (Upgradable)Admin

    Validation layer of the deBridge messaging protocol on this chain: it accepts a cross-chain submission if at least minConfirmations of the registered validators (oracles) have signed its submission ID with a plain ECDSA signature, and every validator flagged as ‘required’ has signed. There is no other proof system.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
      • oracleAddresses: EOA 10, EOA 11, EOA 12, EOA 13, EOA 14, EOA 2, EOA 4, EOA 5, EOA 6, EOA 7, EOA 8, EOA 9
    Can be upgraded by:
    Admin Multisig with no delay
    DlnDestination0xE735…dd7fImplementation (Upgradable)Admin

    Destination side of the deBridge Liquidity Network (DLN) intent protocol: takers fulfill orders here permissionlessly by paying the ‘take’ amount, which is forwarded to the order recipient in the same transaction (this contract holds no user funds). The taker then sends an unlock message back to the source chain’s DlnSource through the deBridge messaging protocol to claim the escrowed maker funds.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
      • govCancel: EOA 1
    Can be upgraded by:
    Admin Multisig with no delay
    DlnSource0xeF4f…EB66Implementation (Upgradable)Admin

    Source-side escrow of the deBridge Liquidity Network (DLN) intent protocol: users lock the ‘give’ funds of a cross-chain order directly in this contract. Funds are released to the taker (claimUnlock) or refunded to the maker (claimCancel) only on a message from the DlnDestination configured for the order’s destination chain, authenticated via the CallProxy of the deBridge messaging protocol (i.e. ultimately by deBridge validator signatures).

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
      • feeCollector: EOA 3
    Can be upgraded by:
    Admin Multisig with no delay
    ProxyAdmin
    2 instances
    0x368F…C4A30xaBAc…283F
    • Roles:
      • owner: EOA 15
    IntentManagerValidator0x4247…CD4b

    Immutable allowlist contract referenced by DlnSource: addresses holding the INTENT_MANAGER_ROLE can create DLN orders with custom or zero protocol fees. It grants no access to existing funds.

    • Roles:
      • defaultAdmin: EOA 16
    ExternalCallAdapter0x61eF…6cF9Implementation (Upgradable)Admin

    Escrow and dispatcher for external calls attached to DLN orders: it receives the taker’s funds of orders that carry calldata and releases them when the calldata is executed by the registered executor, or refunds the order authority on cancellation.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
    Can be upgraded by:
    Admin Multisig with no delay
    DeBridgeRouter0x663D…C251Implementation (Upgradable)Admin

    Optional periphery router that can swap input tokens via whitelisted DEX routers and forward the proceeds into the DLN contracts (order creation, or order fulfillment on the hardcoded DlnDestination via fillCrossChain) in a single transaction. It does not custody funds across transactions and is not part of the DLN critical path.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
    Can be upgraded by:
    Admin Multisig with no delay
    0x6D83…22ccImplementation (Upgradable)Admin

    Unverified proxy referenced as the feeTreasury of the DeBridgeIntentManager.

    • Roles:
      • admin: ProxyAdmin; ultimately EOA 15 The source code of this contract is not verified on Etherscan.
    Can be upgraded by:
    EOA 15 with no delay
    ProxyAdmin
    3 instances
    0xA7b8…F46b0xC86a…71300xE442…94Fe
    • Roles:
      • owner: Admin Multisig
    ExternalCallExecutor0xAE03…7974

    The default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders.

    ProxyAdmin0xb54C…8816
    • Roles:
      • owner: EOA 17
    SimpleFeeProxy0xC2bA…3636Implementation (Upgradable)Admin

    The only contract allowed to withdraw protocol fees accrued in the DeBridgeGate. Fees are paid out directly to the caller of withdrawFees(), so the effective fee destination is whoever holds the FEE_COLLECTOR_ROLE.

    • Roles:
      • admin: ProxyAdmin; ultimately Admin Multisig
      • defaultAdmin: Admin Multisig
      • feeCollector: EOA 3
    Can be upgraded by:
    Admin Multisig with no delay
    DeBridgeToken0xCAce…A98B

    Implementation contract for deBridge-wrapped tokens (deTokens). Minting and burning of deTokens is restricted to the MINTER_ROLE, which is held by the DeBridgeGate.

    0xd2a4…4F07Implementation (Upgradable)Admin

    Unverified proxy holding the INTENT_MANAGER_ROLE on the IntentManagerValidator, allowing it to create DLN orders with custom or zero protocol fees.

    • Roles:
      • admin: ProxyAdmin; ultimately EOA 17 The source code of this contract is not verified on Etherscan.
    Can be upgraded by:
    EOA 17 with no delay
    DeBridgeAllowanceHolder0xdddd…23d0

    Immutable allowance sink of the deBridge intent system: users approve this contract (directly or as Permit2 spender) so that the upgradeable executor contracts never hold approvals themselves. Its transfer functions carry no intent-level checks: any ALLOWED_SPENDER_ROLE holder can move any approved token from any approver to any recipient.

    • Roles:
      • allowedSpender: DeBridgeIntentManager
      • defaultAdmin: EOA 15

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).