Search
Search for projects by name or address
Debridge DLN
About
Intent framework built on top of the deBridge messaging protocol. Maker funds are escrowed in the DlnSource contract on the source chain and released to takers on unlock messages attested by the deBridge validator set.
About
Intent framework built on top of the deBridge messaging protocol. Maker funds are escrowed in the DlnSource contract on the source chain and released to takers on unlock messages attested by the deBridge validator set.
Intent framework built on top of the deBridge messaging protocol. Maker funds are escrowed in the DlnSource contract on the source chain and released to takers on unlock messages attested by the deBridge validator set.
Architecture
The deBridge Liquidity Network (DLN) is an intent protocol built on top of the deBridge messaging protocol, sharing its validation layer and governance. Users (makers) create cross-chain orders by locking their give funds directly in the DlnSource contract on the source chain. On the destination chain, takers fulfill orders through the DlnDestination contract by paying the take amount, which is forwarded to the recipient within the same transaction, so DlnDestination holds no user funds. A protocol fee (currently 0.001 ETH flat plus 4 bps on Ethereum, refunded on cancellation) is deducted from the give amount at order creation.
Order lifecycle
Fulfillment is permissionless — anyone can fill any order unless the maker restricted it — and the filler names an unlock authority for the order. Only that unlock authority can later trigger the unlock, which sends a message back to the source chain’s DlnSource through the DeBridgeGate. Once the deBridge validators attest the message, the escrowed give funds are released to the taker’s chosen beneficiary.
Crosschain validation
DlnSource releases escrowed funds only to calls from the deBridge CallProxy whose authenticated original sender is the DlnDestination address configured for the order’s destination chain (an admin-set, event-tracked map currently routing to 19 chains). The authenticity of that claim rests entirely on the deBridge validator set: a quorum of validator signatures (currently 8 of 12 on Ethereum) attests each unlock or cancellation message. A compromised validator quorum, or an admin change of the per-chain routing addresses, allows draining all order funds escrowed in DlnSource.
User recovery
Unfilled orders can be cancelled from the destination chain by the maker-designated order authority, refunding the full escrow to the maker on the source chain. A GOVERNANCE_DELEGATED_ORDER_CANCEL_ROLE can force-cancel unfulfilled orders on behalf of makers, but refunds can only go to a maker-designated address, making it a liveness rather than a theft power. Fulfilled orders cannot be cancelled.
External calls
Orders can carry calldata to be executed on the destination chain after fulfillment. In that case the taker’s funds are routed to an ExternalCallAdapter escrow, which releases them when the registered executor contract runs the calldata or refunds the order authority on cancellation. The adapter is admin-replaceable in DlnDestination, so a malicious adapter could steal the funds of every order carrying calldata.
Intents
A newer intent-manager stack automates order creation: users sign an EIP-712 intent offchain — the signature covers only an opaque 32-byte intent hash, so wallets cannot display the actual constraints — and permissionless fillers turn intents into DLN orders through the DeBridgeIntentManager. There is no signature nonce; an intent is multi-fill until its budget is exhausted, expired, cancelled or nullified. Input tokens are pulled through the DeBridgeAllowanceHolder, the single immutable contract holding all user approvals of the intent system: its transfer functions carry no intent-level checks, so any holder of its ALLOWED_SPENDER_ROLE can move any approved token from any approver to any recipient. All user protection lives in the constraints of the signed intent itself (price bounds, allowed senders, receivers, budgets); the fill fee is not part of the signed intent and is set by the intent manager admin.
Upgradeability and governance
DlnSource (which escrows all in-flight maker funds), DlnDestination and the ExternalCallAdapter are upgradeable by the same 5/8 deBridge multisig that governs the messaging protocol, with no timelock or exit window. The multisig also holds the DEFAULT_ADMIN_ROLE on both DLN contracts, controlling the trusted cross-chain routing addresses, fees, the external call adapter, and unpausing. The intent-manager stack has a weaker setup: on Ethereum, a single EOA is simultaneously the admin of DeBridgeIntentManager and DeBridgeAllowanceHolder and the owner of the ProxyAdmin that can upgrade the intent manager — an upgrade there could abuse the allowance holder’s spender role to drain all outstanding user approvals. Several satellite contracts have unverified source code.
Monitoring
Order creation, fulfillment, unlock and cancellation all emit events, and the per-chain routing configuration is event-tracked. deBridge provides an explorer (DLN trades are labeled as such) for tracking order flow.
Symbol | Last 24h
Volume | Last 24h
transfer count | Last 24h avg.
transfer time | Last 24h avg.
transfer value | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Timestamp | Tokens | Value | Bridge | Transfer time | Chains | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Ethereum
Actors:
A Multisig with 5/8 threshold.
- Can upgrade with no delay
- DeBridgeGate ProxyAdmin
- ExternalCallAdapter ProxyAdmin
- DeBridgeRouter ProxyAdmin
- DeBridgeTokenDeployer ProxyAdmin
- CallProxy ProxyAdmin
- SignatureVerifier ProxyAdmin
- SimpleFeeProxy ProxyAdmin
- DlnDestination ProxyAdmin
- DlnSource ProxyAdmin
- Can interact with DeBridgeGate
- pause the DeBridgeGate, stopping all sends, claims and deToken deployments on this chain (only the admin can unpause)
- replace the SignatureVerifier (and with it the entire validation layer of the deBridge messaging protocol), the CallProxy and the deToken deployer, censor individual submissions (blockSubmission), toggle supported chains, set all fees and per-address fee discounts, designate the fee withdrawal contract, unpause the gate, and grant/revoke all roles. Most of these setters emit no events
- Can interact with ExternalCallAdapter
- replace the executor contract that handles external calldata of DLN orders and pause the adapter
- Can interact with DeBridgeRouter
- manage the whitelist of swap routers and forwarding targets this contract may call with arbitrary calldata (and grant infinite token approvals to), set the service fee and fee treasury, and sweep any funds held by the router
- Can interact with DeBridgeTokenDeployer
- administer all deployed deTokens: pause their transfers and grant/revoke minter rights, including the ability to grant itself the right to mint unbacked deTokens
- replace the implementation of all deTokens at once (this contract acts as their beacon), change the admin assigned to newly deployed deTokens, and override deToken names/symbols. None of these setters emit events
- Can interact with CallProxy
- grant and revoke the DEBRIDGE_GATE_ROLE that authorizes contracts to execute arbitrary external calls through the CallProxy
- Can interact with SignatureVerifier
- add and remove deBridge validators (oracles), change all signature thresholds (quorum must remain a majority of the oracle set), and re-point the gate contract allowed to request verification. Threshold changes emit no events
- Can interact with SimpleFeeProxy
- grant/revoke the FEE_COLLECTOR_ROLE that receives all deBridge protocol fees, pause fee withdrawals, and change the referenced gate contract
- Can interact with DlnDestination
- set the trusted DlnSource address (message receiver) for each supported chain, replace the external call adapter that custodies funds of orders with attached calldata, unpause the contract, and grant/revoke all roles
- Can interact with DlnSource
- set the trusted DlnDestination address for each supported chain (a malicious address there can drain all escrowed order funds via forged unlock messages), change DLN fees without upper bound, unpause the contract, and grant/revoke all roles
Fills user-signed intents by creating DLN orders on their behalf: it pulls input tokens from users through the DeBridgeAllowanceHolder (Permit2 or direct approvals) and forwards them into DlnSource in the same transaction, charging a variable fee that is NOT part of the user-signed intent. It is non-custodial in steady state. Note that the EIP-712 signature users sign covers only an opaque intent hash, and fills are permissionless unless the intent restricts senders.
- Can interact with DeBridgeAllowanceHolder
- unconditionally transfer any amount of any token from any user who approved the DeBridgeAllowanceHolder (directly or via Permit2) to any recipient, and make arbitrary calls from its address
- Can interact with DlnDestination
- force-cancel any not-yet-fulfilled order that has a cancel beneficiary set by its maker (refunds can only go to that maker-designated address)
- Can interact with SimpleFeeProxy
- withdraw all protocol fees accrued in the DeBridgeGate to itself
- Can interact with DlnSource
- withdraw accumulated DLN protocol fees (not user principal) to itself
- Can upgrade with no delay
- ProxyAdmin
- DeBridgeIntentManager ProxyAdmin
- Can interact with DeBridgeAllowanceHolder
- grant and revoke the ALLOWED_SPENDER_ROLE, i.e. authorize any address (including itself) to spend all outstanding user approvals of the deBridge intent system
- Can interact with DeBridgeIntentManager
- set intent fill fees up to 100% with immediate effect (fees are not part of the user-signed intent), manage the trusted solver set, sweep funds held by the contract, and grant/revoke all roles
- Can interact with IntentManagerValidator
- grant and revoke the INTENT_MANAGER_ROLE that allows creating DLN orders with custom or zero protocol fees
- Can upgrade with no delay
- ProxyAdmin
Ethereum
Central hub of the deBridge messaging protocol on this chain: it emits cross-chain submissions (asset transfers and/or arbitrary messages), locks and releases native assets, mints and burns deBridge-wrapped assets (deTokens), and executes claimed submissions after their validator signatures are checked by the SignatureVerifier. Claiming is permissionless: anyone can execute a submission that carries enough validator signatures.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
- govMonitoring: Admin Multisig
Deploys deBridge-wrapped token (deToken) contracts when an asset is bridged to this chain for the first time (callable only by the DeBridgeGate). All deTokens are beacon proxies whose beacon is this contract itself, so its tokenImplementation applies to every deToken on this chain at once.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- deBridgeTokenAdmin: Admin Multisig
- defaultAdmin: Admin Multisig
Sandbox that executes arbitrary calldata attached to claimed cross-chain submissions on behalf of the DeBridgeGate. Calls are performed from this contract’s address with attacker-choosable target and data, so external contracts must never trust it as a caller; it isolates such calls from the gate’s balances.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
Validation layer of the deBridge messaging protocol on this chain: it accepts a cross-chain submission if at least minConfirmations of the registered validators (oracles) have signed its submission ID with a plain ECDSA signature, and every validator flagged as ‘required’ has signed. There is no other proof system.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
- oracleAddresses: EOA 10, EOA 11, EOA 12, EOA 13, EOA 14, EOA 2, EOA 4, EOA 5, EOA 6, EOA 7, EOA 8, EOA 9
Destination side of the deBridge Liquidity Network (DLN) intent protocol: takers fulfill orders here permissionlessly by paying the ‘take’ amount, which is forwarded to the order recipient in the same transaction (this contract holds no user funds). The taker then sends an unlock message back to the source chain’s DlnSource through the deBridge messaging protocol to claim the escrowed maker funds.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
- govCancel: EOA 1
Source-side escrow of the deBridge Liquidity Network (DLN) intent protocol: users lock the ‘give’ funds of a cross-chain order directly in this contract. Funds are released to the taker (claimUnlock) or refunded to the maker (claimCancel) only on a message from the DlnDestination configured for the order’s destination chain, authenticated via the CallProxy of the deBridge messaging protocol (i.e. ultimately by deBridge validator signatures).
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
- feeCollector: EOA 3
- Roles:
- owner: EOA 15
Immutable allowlist contract referenced by DlnSource: addresses holding the INTENT_MANAGER_ROLE can create DLN orders with custom or zero protocol fees. It grants no access to existing funds.
- Roles:
- defaultAdmin: EOA 16
Escrow and dispatcher for external calls attached to DLN orders: it receives the taker’s funds of orders that carry calldata and releases them when the calldata is executed by the registered executor, or refunds the order authority on cancellation.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
Optional periphery router that can swap input tokens via whitelisted DEX routers and forward the proceeds into the DLN contracts (order creation, or order fulfillment on the hardcoded DlnDestination via fillCrossChain) in a single transaction. It does not custody funds across transactions and is not part of the DLN critical path.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
Unverified proxy referenced as the feeTreasury of the DeBridgeIntentManager.
- Roles:
- admin: ProxyAdmin; ultimately EOA 15 The source code of this contract is not verified on Etherscan.
- Roles:
- owner: Admin Multisig
The default executor in the ExternalCallAdapter: it executes external calldata attached to DLN orders.
- Roles:
- owner: EOA 17
The only contract allowed to withdraw protocol fees accrued in the DeBridgeGate. Fees are paid out directly to the caller of withdrawFees(), so the effective fee destination is whoever holds the FEE_COLLECTOR_ROLE.
- Roles:
- admin: ProxyAdmin; ultimately Admin Multisig
- defaultAdmin: Admin Multisig
- feeCollector: EOA 3
Implementation contract for deBridge-wrapped tokens (deTokens). Minting and burning of deTokens is restricted to the MINTER_ROLE, which is held by the DeBridgeGate.
Unverified proxy holding the INTENT_MANAGER_ROLE on the IntentManagerValidator, allowing it to create DLN orders with custom or zero protocol fees.
- Roles:
- admin: ProxyAdmin; ultimately EOA 17 The source code of this contract is not verified on Etherscan.
Immutable allowance sink of the deBridge intent system: users approve this contract (directly or as Permit2 spender) so that the upgradeable executor contracts never hold approvals themselves. Its transfer functions carry no intent-level checks: any ALLOWED_SPENDER_ROLE holder can move any approved token from any approver to any recipient.
- Roles:
- allowedSpender: DeBridgeIntentManager
- defaultAdmin: EOA 15
The current deployment carries some associated risks:
Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).