# Eclipse

Markdown version of https://l2beat.com/layer2s/projects/eclipse

## Summary

**Warning:** Why is the project listed in others? The proof system isn't fully functional. Consequence: projects without a proper proof system fully rely on single entities to safely update the state. A malicious proposer can finalize an invalid state, which can cause loss of funds. There is no data availability bridge. Consequence: projects without a data availability bridge fully rely on single entities (the sequencer) to honestly rely available data roots on Ethereum. A malicious sequencer can collude with the proposer to finalize an unavailable state, which can cause loss of funds. Learn more about the [recategorisation](https://medium.com/l2beat/framework-update-l2-projects-recategorisation-5d43b0d1fe50).

- Total Value Secured: $5.16 M (-2.23% compared to seven days ago; canonically bridged $5.16 M, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge)
- TVS by asset: ETH & derivatives $5.16 M (100%)
- Past day UOPS: 2.84 (-1.65% compared to seven days ago)
- Type: Other
- Purpose: Universal
- Host chain: Ethereum

### Risks

- Sequencer failure: No mechanism (sentiment: bad)
- State validation: None (7d challenge period; sentiment: bad)
- Data availability: External (sentiment: bad)
- Exit window: None (sentiment: bad)
- Proposer failure: Cannot withdraw (sentiment: bad)

### About

Eclipse is a sidechain powered by the Solana Virtual Machine (SVM).

### Links

- Website: https://eclipse.xyz/
- Bridge: https://app.eclipse.xyz/
- Docs: https://docs.eclipse.xyz/
- Explorer: https://eclipsescan.xyz/
- Repository: https://github.com/Eclipse-Laboratories-Inc
- Social: https://twitter.com/eclipsefnd, https://discord.com/invite/eclipse-fnd, https://mirror.xyz/eclipsemainnet.eth
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/eclipse

### Badges

- SolanaVM: This project uses the Solana Virtual Machine to run its smart contracts
- Celestia: This project is posting its data to Celestia

## Value Secured

The interactive TVS charts are shown on [the HTML page](https://l2beat.com/layer2s/projects/eclipse#tvs).

Token by token: [TVS breakdown](https://l2beat.com/layer2s/projects/eclipse/tvs-breakdown).

- [TVS chart (JSON)](https://l2beat.com/api/scaling/tvs/eclipse)
- [TVS breakdown by token (JSON)](https://l2beat.com/api/scaling/tvs/eclipse/breakdown)

## Activity

The interactive activity chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/eclipse#activity).

- [Activity chart (JSON)](https://l2beat.com/api/scaling/activity/eclipse)

## Risk summary

### Funds can be stolen if

1. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
2. the Treasury owner decides to transfer the funds locked on L1.

### Funds can be frozen if

3. celestia becomes unavailable and transaction data cannot be retrieved.

### Users can be censored if

4. the bridge operators decide not to mint tokens after observing a deposit.

## Risk analysis

### Sequencer failure

No mechanism (sentiment: bad)

There is no mechanism to have transactions be included if the sequencer is down or censoring.

### State validation

None (7d challenge period; sentiment: bad)

Currently the system permits invalid state roots. More details in project overview.

### Data availability

External (sentiment: bad)

Proof construction and state derivation fully rely on data that is posted on Celestia. Sequencer tx roots are not checked against the Blobstream bridge data roots onchain, but L2 nodes can verify data availability by running a Celestia light client.

### Exit window

None (sentiment: bad)

There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

### Proposer failure

Cannot withdraw (sentiment: bad)

Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen.

## Data availability

### Data is posted to Celestia

Eclipse uses Celestia for data availability.

There is no automatic fallback mechanism to Ethereum for data availability. If Celestia becomes unavailable, the chain relies entirely on Celestia for transaction data recovery.

**Risks**

- Funds can be frozen if celestia becomes unavailable and transaction data cannot be retrieved.

**References**

- [Eclipse Celestia Integration](https://docs.eclipse.xyz/architecture/eclipse-architecture/modular-components-of-eclipse#data-availability-celestia)

## State validation

### No state validation

Eclipse implements a custom permissioned bridge. Withdrawals need to be actively authorized by the 2/4 Eclipse Multisig. Moreover, there is no mechanism to send arbitrary messages from Eclipse back to Ethereum. There is a 7d delay for withdrawals.

**Risks**

- Users can be censored if the bridge operators decide not to mint tokens after observing a deposit.
- Funds can be stolen if the Treasury owner decides to transfer the funds locked on L1.

**References**

- [CanonicalBridge.sol - Etherscan source code, authorizeWithdraw() function](https://etherscan.io/address/0x504392F02ee64D6B51aD3bCf7999E69EBe28b30a#code#F1#L237)
- [Mailbox.sol - Etherscan source code, receiveMessage() function calls CanonicalBridge](https://etherscan.io/address/0x4cef0fa54dc06ce0ea198dab2f57d28a9dee712b#code#F1#L199)
- [Treasury.sol - Etherscan source code, emergencyWithdraw() function](https://etherscan.io/address/0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978#code)

## Upgrades & Governance

### Past upgrades

The metrics include upgrades on the currently used proxy contracts. Historical proxy contracts and changes of such are not included.

- Count of upgrades: 1
- Last upgrade: 1y 11mo ago
- Avg upgrade interval: 1y 1mo

- 2024-11-05 03:53 UTC, upgrade of [Treasury](https://etherscan.io/address/0xD7E4b67E735733aC98a88F13d087D8aac670E644#code): transaction [0x15aecc2b0cac5c03221b0f7ade10e888ad4f944df4bdc19c1f3c40fc56d5ebbb](https://etherscan.io/tx/0x15aecc2b0cac5c03221b0f7ade10e888ad4f944df4bdc19c1f3c40fc56d5ebbb), implementations: [0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978](https://etherscan.io/address/0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978#code) ([diff](https://disco.l2beat.com/diff/eth:0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4/eth:0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978))
- 2024-07-28 04:29 UTC, deployment of [Treasury](https://etherscan.io/address/0xD7E4b67E735733aC98a88F13d087D8aac670E644#code): transaction [0xa34790c0635f1f739540bf7e2998085e6426d1f17cd58617e26be884f625a0dc](https://etherscan.io/tx/0xa34790c0635f1f739540bf7e2998085e6426d1f17cd58617e26be884f625a0dc), implementations: [0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4](https://etherscan.io/address/0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4#code)

## Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-10-12 07:18 UTC](https://l2beat.com/layer2s/projects/eclipse?update=45a75af8) (2 changes)

The bridge-controlling Eclipse Multisig lowered its threshold from 3/4 to 2/4. Two signers can now exercise its withdrawal and administration powers.

### [2025-11-20 10:56 UTC](https://l2beat.com/layer2s/projects/eclipse?update=a2d524dd) (16 changes)

- CanonicalBridgeV1 cannot be used to withdraw funds from Treasury anymore.
- CanonicalBridgeV2 deactivated, replaced by CanonicalBridgeV3:
the main change in V3 is new events via DepositedWithId and depositIndex, V3 can settle v1 and v2 pending withdrawals
https://disco.l2beat.com/diff/eth:0x867A8FcD5Bb6774d4d37fb342D669A35FF789a51/eth:0x504392F02ee64D6B51aD3bCf7999E69EBe28b30a

### [2025-09-08 14:36 UTC](https://l2beat.com/layer2s/projects/eclipse?update=f417c074) (2 changes)

ms signer removed.

### [2025-07-14 12:44 UTC](https://l2beat.com/layer2s/projects/eclipse?update=387faee0) (9 changes)

Discovery rerun on the same block number with only config-related changes.

### [2025-07-07 17:02 UTC](https://l2beat.com/layer2s/projects/eclipse?update=16d097aa) (12 changes)

discodrive.

new contract 'canonicalBridgeV2' added with [minimal diff to the old one.](https://disco.l2beat.com/diff/eth:0x2B08D7cF7EafF0f5f6623d9fB09b080726D4be11/eth:0x867A8FcD5Bb6774d4d37fb342D669A35FF789a51)

### [2024-11-05 12:13 UTC](https://l2beat.com/layer2s/projects/eclipse?update=b5fb62cb) (high severity, 28 changes)

Bridge upgrade without major logic changes.

#### EtherBridge
- Now called CanonicalBridge.sol
- More granular roles (AuthorityMultisig still main admin)
- 'FraudWindow' of 7d introduced for normal withdrawals (but still using permissioned withdrawals, and Treasury allows permissioned direct emergencyWithdraw())
- Two step process for withdrawals interfaces with the bridge and not the Treasury directly: 1) `authorizeWithdraw()` by permissioned actor any time 2) `claimWithdraw()` after 7d by anyone

#### Treasury
- AccessControl and SemVer added
- minor changes

#### EtherBridge

### [2024-11-01 10:58 UTC](https://l2beat.com/layer2s/projects/eclipse?update=7174cfac) (8 changes)

Multisig members change and threshold increase, also added a pending owner. Waiting for the new owner to accept the ownership transfer.

### [2024-10-25 10:10 UTC](https://l2beat.com/layer2s/projects/eclipse?update=82c18f59) (4 changes)

Single signer changed in AuthorityMultisig.

### [2024-10-19 06:18 UTC](https://l2beat.com/layer2s/projects/eclipse?update=6fba6493) (6 changes)

Threshold of the AuthorityMultisig raised to 2. As long as there are no withdrawals, the AuthorityMultisig is essentially a pauser only since upgrades do not change the withdrawals and can only affect a 'virtual' state on the L2 (from ethereum perspective).

### [2024-10-17 13:35 UTC](https://l2beat.com/layer2s/projects/eclipse?update=392c1f2d) (4 changes)

To harden security in the context of recent Multisig hacks, Eclipse chose to add another signer to their multisig. In a sudden clouding of their minds, they forgot to raise the threshold and ended up weakening security instead.

### [2024-09-18 07:09 UTC](https://l2beat.com/layer2s/projects/eclipse?update=eaf90f36) (6 changes)

One signer removed from TreasuryOwner.

### [2024-09-15 14:50 UTC](https://l2beat.com/layer2s/projects/eclipse?update=e7ffebe0) (8 changes)

Add two signers to the TreasuryOwner MS.

### [2024-09-02 14:35 UTC](https://l2beat.com/layer2s/projects/eclipse?update=95463469) (1 change)

Discovery of newly verified contracts.

### [2024-08-23 10:14 UTC](https://l2beat.com/layer2s/projects/eclipse?update=6931c7a7) (25 changes)

Discovery rerun on the same block number with only config-related changes.

### [2024-08-12 10:45 UTC](https://l2beat.com/layer2s/projects/eclipse?update=f84a7b2b) (4 changes)

Provide description of changes. This section will be preserved.

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/eclipse

### Ethereum

#### Actors

##### Eclipse Multisig

Addresses: [0x4720342419C1D316B948690d12C86D5b485C64E0](https://etherscan.io/address/0x4720342419C1D316B948690d12C86D5b485C64E0)

A Multisig with 2/4 threshold.
- Can interact with CanonicalBridgeV3
  - authorize withdrawals to any address
  - grant / revoke all access control roles and thus access all permissioned functions in the contract
  - pause the contract for deposits and withdrawals
- Can interact with Upgrader0to1
  - start an upgrade of the core contracts
- Can interact with Treasury
  - grant / revoke all access control roles and thus access all permissioned functions in the contract

Participants (4): [0xBb534A6Bd0440727cb5883D037DEd7358059D547](https://etherscan.io/address/0xBb534A6Bd0440727cb5883D037DEd7358059D547), [0x950815d0e585095B06111CD101440fb1E95AB2a5](https://etherscan.io/address/0x950815d0e585095B06111CD101440fb1E95AB2a5), [0x757210F15AB48f0F8d328984fc321CfA6BB5BFc2](https://etherscan.io/address/0x757210F15AB48f0F8d328984fc321CfA6BB5BFc2), [0xF48C91ca69Aef5ac47E430c3E90DEE1694d246FA](https://etherscan.io/address/0xF48C91ca69Aef5ac47E430c3E90DEE1694d246FA)

##### Eclipse Multisig 2

Addresses: [0x7B2c1CbB33c53c3C6a695e36096AD2cfCE1c0efC](https://etherscan.io/address/0x7B2c1CbB33c53c3C6a695e36096AD2cfCE1c0efC)

A Multisig with 3/5 threshold.
- Can upgrade **with no delay**
  - Treasury
- Can interact with Treasury
  - grant / revoke all access control roles and thus access all permissioned functions in the contract
  - withdraw ETH from the contract, even when it is paused
  - withdraw ETH from the contract

Participants (5): [0xd0615B1D3F24f691153C076d45104eEd3eF8cDb5](https://etherscan.io/address/0xd0615B1D3F24f691153C076d45104eEd3eF8cDb5), [0x0706Ffc1722D53a85ba90f32807880ccee968Fed](https://etherscan.io/address/0x0706Ffc1722D53a85ba90f32807880ccee968Fed) (GnosisSafe), [0xDecF20b9213f5d7f16196420377d37ef5f8F9686](https://etherscan.io/address/0xDecF20b9213f5d7f16196420377d37ef5f8F9686), [0xEe058D13A0c25a1ce2f68eb02dE4CE7E621982D9](https://etherscan.io/address/0xEe058D13A0c25a1ce2f68eb02dE4CE7E621982D9), [0x3392fd462d9710Fbf3A5703818b9920C119DC080](https://etherscan.io/address/0x3392fd462d9710Fbf3A5703818b9920C119DC080)

##### EOA 1

Addresses: [0x1a84163249B2909f746C725F23D5ae2a66D7C4fE](https://etherscan.io/address/0x1a84163249B2909f746C725F23D5ae2a66D7C4fE)

- Can interact with CanonicalBridgeV3
  - authorize withdrawals to any address

## Smart contracts

![A diagram of the smart contract architecture](https://l2beat.com/static/images/architecture/eclipse.ef90073a.png)

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/eclipse

### Ethereum

#### CanonicalBridgeV3

Addresses: [0x504392F02ee64D6B51aD3bCf7999E69EBe28b30a](https://etherscan.io/address/0x504392F02ee64D6B51aD3bCf7999E69EBe28b30a#code)

Entry point to deposit and withdraw ETH. There is no canonical messaging system. Deposited funds are sent to a Treasury contract and withdrawals must be authorized by a permissioned actor.
- Roles:
  - **defaultAdmin**: Eclipse Multisig
  - **pauser**: Eclipse Multisig
  - **withdrawAuthority**: EOA 1, Eclipse Multisig

#### Treasury

Addresses: [0xD7E4b67E735733aC98a88F13d087D8aac670E644](https://etherscan.io/address/0xD7E4b67E735733aC98a88F13d087D8aac670E644#code), [0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978](https://etherscan.io/address/0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin)

**Past upgrades** (Count of upgrades: 1, Last upgrade: 1y 11mo ago, Avg upgrade interval: 1y 1mo)

- 2024-11-05 03:53 UTC, upgrade of [Treasury](https://etherscan.io/address/0xD7E4b67E735733aC98a88F13d087D8aac670E644#code): transaction [0x15aecc2b0cac5c03221b0f7ade10e888ad4f944df4bdc19c1f3c40fc56d5ebbb](https://etherscan.io/tx/0x15aecc2b0cac5c03221b0f7ade10e888ad4f944df4bdc19c1f3c40fc56d5ebbb), implementations: [0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978](https://etherscan.io/address/0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978#code) ([diff](https://disco.l2beat.com/diff/eth:0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4/eth:0xF1F7a359C3f33EE8A66bdCbf4c897D25Caf90978))
- 2024-07-28 04:29 UTC, deployment of [Treasury](https://etherscan.io/address/0xD7E4b67E735733aC98a88F13d087D8aac670E644#code): transaction [0xa34790c0635f1f739540bf7e2998085e6426d1f17cd58617e26be884f625a0dc](https://etherscan.io/tx/0xa34790c0635f1f739540bf7e2998085e6426d1f17cd58617e26be884f625a0dc), implementations: [0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4](https://etherscan.io/address/0xa8E15d2B1bf6B0Fd3Bc9Ead06323c0730b67f8d4#code)

Permissioned escrow for assets bridged to Eclipse. There is no canonical messaging and users need to trust the bridge operators to process deposits and authorize withdrawals.
- Roles:
  - **defaultAdmin**: Eclipse Multisig, Eclipse Multisig 2
  - **emergency**: Eclipse Multisig 2, Upgrader0to1
  - **upgrader**: Eclipse Multisig 2, Upgrader0to1
  - **withdrawer**: CanonicalBridgeV3, Eclipse Multisig 2

Can be upgraded by: Eclipse Multisig 2 with no delay

#### Upgrader0to1

Addresses: [0xD02f545d57536BC1E8F12D867731F006AacE71E3](https://etherscan.io/address/0xD02f545d57536BC1E8F12D867731F006AacE71E3#code)

This contract was used for an upgrade an still retains its permissions and permissioned actors.
- Roles:
  - **upgrader**: Eclipse Multisig

The current deployment carries some associated risks:

- Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).