# Fluent

Markdown version of https://l2beat.com/layer2s/projects/fluent

## Summary

**Warning:** Why is the project listed in others? The proof system isn't fully functional. Consequence: projects without a proper proof system fully rely on single entities to safely update the state. A malicious proposer can finalize an invalid state, which can cause loss of funds. Learn more about the [recategorisation](https://medium.com/l2beat/framework-update-l2-projects-recategorisation-5d43b0d1fe50).

- Total Value Secured: $1.54 M (-9.17% compared to seven days ago; canonically bridged $1.54 M, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge)
  - **Warning:** The BLEND token associated with Fluent accounts for 95.8% of the TVS! (sentiment: bad)
- TVS by asset: ETH & derivatives $64.24 K (4.16%), Stablecoins $131.97 (0.00%), BTC & derivatives $130.22 (0.00%), Other $1.47 M (95.8%)
- Associated tokens: BLEND: $1.47 M (95.8% of TVS)
- Past day UOPS: 0.03 (-3.33% compared to seven days ago)
- Gas token: ETH
- Type: Other
- Purpose: Universal
- Host chain: Ethereum
- Chain ID: 25363

### Risks

- Sequencer failure: No mechanism (sentiment: bad)
- State validation: TEE attestations (sentiment: bad)
- Data availability: Onchain (sentiment: good)
- Exit window: None (sentiment: bad)
- Proposer failure: Cannot withdraw (sentiment: bad)

### About

Fluent is an Ethereum L2 that blends Wasm and EVM smart contracts into a unified execution environment (with SVM planned). Batches are preconfirmed by an AWS Nitro Enclave and finalize after a delay; challenges are resolved by SP1 ZK proofs.

### Links

- Website: https://fluent.xyz/
- Bridge: https://portal.fluent.xyz/user/bridge
- Docs: https://docs.fluent.xyz/
- Explorer: https://fluentscan.xyz/
- Repository: https://github.com/fluentlabs-xyz
- Social: https://x.com/fluentxyz, https://linkedin.com/company/fluentxyz, https://discord.com/invite/fluentxyz
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/fluent

### Badges

- EVM: This project uses the Ethereum Virtual Machine to run its smart contracts and supports the Solidity programming language
- WasmVM: This project uses a WebAssembly Virtual Machine to run its smart contracts

## Value Secured

The interactive TVS charts are shown on [the HTML page](https://l2beat.com/layer2s/projects/fluent#tvs).

Token by token: [TVS breakdown](https://l2beat.com/layer2s/projects/fluent/tvs-breakdown).

- [TVS chart (JSON)](https://l2beat.com/api/scaling/tvs/fluent)
- [TVS breakdown by token (JSON)](https://l2beat.com/api/scaling/tvs/fluent/breakdown)

## Activity

The interactive activity chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/fluent#activity).

- [Activity chart (JSON)](https://l2beat.com/api/scaling/activity/fluent)

## Onchain costs

The section shows the operating costs that L2s pay to Ethereum.

The interactive costs chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/fluent#onchain-costs).

### Tracked transactions

#### Batch submissions

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0xec0f2437; signature: `function commitBatch(bytes32 batchRoot, bytes32 fromBlockHash, bytes32 toBlockHash, uint24 numberOfBlocks, (bytes32 depositRoot, uint16 depositCount)[] blockDeposits, uint8 expectedBlobsCount)`
- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0xf4405170; signature: `function submitBlobs(uint256 batchIndex, uint256 numBlobs)`

#### Proof submissions

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x279a71f5; signature: `function finalizeWithProofs(uint256 batchIndex, (bytes32 previousBlockHash, bytes32 blockHash, bytes32 withdrawalRoot, bytes32 depositRoot, uint16 depositCount)[] blockHeaders)`

#### State updates

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x94abf0e7; signature: `function finalizeBatches(uint256 toBatchIndex)`
- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x279a71f5; signature: `function finalizeWithProofs(uint256 batchIndex, (bytes32 previousBlockHash, bytes32 blockHash, bytes32 withdrawalRoot, bytes32 depositRoot, uint16 depositCount)[] blockHeaders)`

## Data posted

This section shows how much data the project publishes to Ethereum over time. It leaves out data posted to other data-availability (DA) layers. The project currently posts data to [Ethereum](https://l2beat.com/projects/ethereum).

The interactive data posted chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/fluent#data-posted).

### Tracked transactions

#### Blob submissions

- DA layer Ethereum: from block 24913710 to now; currently used; inbox: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); sequencers: [0xFd58Bc438d910088C413b889Eaa0aded5C0d1c26](https://etherscan.io/address/0xFd58Bc438d910088C413b889Eaa0aded5C0d1c26)

## Liveness

This section shows how "live" the project's operators are by displaying how frequently they submit transactions of the selected type. It also highlights anomalies - significant deviations from their typical schedule.

No ongoing anomalies detected.

The interactive liveness chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/fluent#liveness).

### Tracked transactions

#### Batch submissions

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0xec0f2437; signature: `function commitBatch(bytes32 batchRoot, bytes32 fromBlockHash, bytes32 toBlockHash, uint24 numberOfBlocks, (bytes32 depositRoot, uint16 depositCount)[] blockDeposits, uint8 expectedBlobsCount)`
- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0xf4405170; signature: `function submitBlobs(uint256 batchIndex, uint256 numBlobs)`

#### Proof submissions

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x279a71f5; signature: `function finalizeWithProofs(uint256 batchIndex, (bytes32 previousBlockHash, bytes32 blockHash, bytes32 withdrawalRoot, bytes32 depositRoot, uint16 depositCount)[] blockHeaders)`

#### State updates

- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x94abf0e7; signature: `function finalizeBatches(uint256 toBatchIndex)`
- functionCall: 2026-04-19 11:47 UTC - now; currently used; address: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f); selector: 0x279a71f5; signature: `function finalizeWithProofs(uint256 batchIndex, (bytes32 previousBlockHash, bytes32 blockHash, bytes32 withdrawalRoot, bytes32 depositRoot, uint16 depositCount)[] blockHeaders)`

## Milestones & Incidents

- 2026-04-24: [Fluent mainnet launch](https://x.com/fluentxyz/status/2047662772658622465). Fluent activates its Ethereum L2 mainnet alongside the BLEND token launch.

## Risk summary

**Warning:** The project relies on program hashes that could not be successfully reproduced from their published sources (CRITICAL).

### Funds can be stolen if

1. the AWS Nitro Enclave attestation key is compromised and the operator preconfirms an invalid batch within the rate-limited window,
2. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
3. an invalid batch is preconfirmed by a compromised AWS Nitro Enclave and no permissioned challenger disputes it before the challenge window closes.

### Users can be censored if

4. the operator refuses to include their transactions.

### MEV can be extracted if

5. the operator exploits their centralized position and frontruns user transactions.

## Risk analysis

### Sequencer failure

No mechanism (sentiment: bad)

There is no mechanism to have transactions be included if the sequencer is down or censoring.

### State validation

TEE attestations (sentiment: bad)

State roots are accepted on the basis of an AWS Nitro Enclave preconfirmation and a 2d time delay; the SP1 ZK proof system exists in the contracts but is currently unreachable because CHALLENGER_ROLE has no holders. Effective security reduces to trust the TEE and wait the delay. See the State Validation section below for details.

### Data availability

Onchain (sentiment: good)

All of the data needed for proof construction is published on Ethereum L1.

### Exit window

None (sentiment: bad)

There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

### Proposer failure

Cannot withdraw (sentiment: bad)

Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen.

## Data availability

### All data required for proofs is published on chain

All the data that is used to construct the system state is published on chain in the form of cheap blobs or calldata. This ensures that it will be available for enough time. Fluent posts transaction data to Ethereum L1 as EIP-4844 blobs. Blob hashes are pinned on the Rollup contract via `submitBlobs` and SP1 proofs verify that block data matches both the pinned hashes and the EIP-4844 commitments.

**References**

- [Fluent Rollup Architecture - Blob Publication](https://docs.fluent.xyz/system-architecture/rollup-architecture)

Learn more about the DA layer here: [Ethereum](https://l2beat.com/projects/ethereum)

## State validation

### Challenges

Fluent runs an optimistic batch lifecycle backed by SP1 ZK proofs for dispute resolution. (1) the sequencer commits a batch root via `commitBatch`; (2) EIP-4844 blob hashes are pinned via `submitBlobs`; (3) an AWS Nitro Enclave preconfirms the batch with an ECDSA signature whose key was admitted onchain only after an SP1 proof verified AWS's attestation document for that key and that the document's PCR0 (a fingerprint of the enclave image) matches the expected (audited) value; (4) within 1d 12h of acceptance, addresses with the `CHALLENGER_ROLE` can dispute via `challengeBatchRoot` or `challengeBlock` and the prover must resolve each challenge with an SP1 proof before the same window closes; (5) batches finalize either after a 2d L1 delay (`finalizeBatches`, no proof needed in the happy path) or immediately once all challenged blocks are proven (`finalizeWithProofs`).

Currently `CHALLENGER_ROLE` has no holders, so `challengeBatchRoot` and `challengeBlock` cannot be invoked. Because `_provenBlocks` is only populated inside `resolveBlockChallenge` (which itself requires an active challenge), no SP1 proof can be submitted onchain in this state and `finalizeWithProofs` reverts. Every batch therefore finalizes purely through the time-based path, and effective security reduces to trust the TEE plus the 2d delay until the admin grants the role.

The `PROVER`, `EMERGENCY`, and `CHALLENGER` roles on the Rollup are gated by access control; see the Permissions section for the current holders.

**Risks**

- Funds can be stolen if an invalid batch is preconfirmed by a compromised AWS Nitro Enclave and no permissioned challenger disputes it before the challenge window closes.

**References**

- [Fluent Rollup Architecture](https://docs.fluent.xyz/system-architecture/rollup-architecture)
- [Fluent Bridge Architecture](https://docs.fluent.xyz/system-architecture/bridge)

### Program Hashes

#### Fluent STF guest program

Guest program implementing state transition function of the Fluent rollup

- Hash: `0x00e34107e4c5284bd4ecc4269c650671038c1e85d9dacb931b534e984f607334`
- Repository: code unknown
- Verification: unsuccessful
- Used in: [Fluent](https://l2beat.com/layer2s/projects/fluent)

##### Verification steps

According to the Fluent team, the sources for this program were not yet published. Thus it cannot be verified.

#### Fluent Nitro TEE verifier v1.0.7

Verifies correctness of a single TEE attestation for executing Fluent STF within a trusted enclave on AWS cloud.

- Hash: `0x00f291835495d0af627923c963f18395bb9a7e6783b694497460f757866ea34b`
- Repository: https://github.com/fluentlabs-xyz/fluent-stf/tree/v1.0.7/bin/aws-nitro-validator
- Verification: successful
- Used in: [Fluent](https://l2beat.com/layer2s/projects/fluent)

##### Verification steps

Regeneration steps are based on [this guide](https://github.com/fluentlabs-xyz/fluent-stf/blob/v1.0.7/README.md). The process is reproducible on a Linux x86_64 (amd64) machine.

1. Install prerequesits: `docker`, `python3`, `git`, `jq`.
2. Checkout correct branch in https://github.com/fluentlabs-xyz/fluent-stf/tree/v1.0.7: `git checkout v1.0.7`. Commit hash should be `7e4db8ca602c93fa54f831a4de49b0285fc3ad18`.
3. Build Nitro program for the mainnet within docker: `make build-nitro-validator-docker NETWORK=mainnet`. This command will create `nitro-validator-mainnet.vkey` file with the program hash string.

## Upgrades & Governance

### Past upgrades

The metrics include upgrades on the currently used proxy contracts. Historical proxy contracts and changes of such are not included.

- Count of upgrades: 17
- Last upgrade: 4mo 28d ago
- Avg upgrade interval: 1mo 5d

- 2026-05-20 15:00 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x5683f1be2880db1238db0cafc17623f895de685541543b5fd577efdfec53429c](https://etherscan.io/tx/0x5683f1be2880db1238db0cafc17623f895de685541543b5fd577efdfec53429c), implementations: [0xF67255be817061139C9DeeA757f7276916cBF849](https://etherscan.io/address/0xF67255be817061139C9DeeA757f7276916cBF849#code) ([diff](https://disco.l2beat.com/diff/eth:0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227/eth:0xF67255be817061139C9DeeA757f7276916cBF849))
- 2026-04-23 01:38 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x2625ebb9ea1e887805cc22e6d221a6e13f79d0db0b5acac9815e3231d39b0ce6](https://etherscan.io/tx/0x2625ebb9ea1e887805cc22e6d221a6e13f79d0db0b5acac9815e3231d39b0ce6), implementations: [0x81e1158368bD28Cc6E8380852087a9512A9670fB](https://etherscan.io/address/0x81e1158368bD28Cc6E8380852087a9512A9670fB#code) ([diff](https://disco.l2beat.com/diff/eth:0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b/eth:0x81e1158368bD28Cc6E8380852087a9512A9670fB))
- 2026-04-22 16:35 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x656d50f10e86f6bbee1bd4c39258cc2ebf75341d74be55c3163b7ed990c931b6](https://etherscan.io/tx/0x656d50f10e86f6bbee1bd4c39258cc2ebf75341d74be55c3163b7ed990c931b6), implementations: [0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1](https://etherscan.io/address/0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1#code) ([diff](https://disco.l2beat.com/diff/eth:0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd/eth:0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1))
- 2026-04-20 21:35 UTC, deployment of [Blacklist](https://etherscan.io/address/0x05C5d46a5e6f92fB9CdA9A8b03E4440A175D1484#code): transaction [0x48b82ab6b95e56504680c0c5d8b75a9a389e4619bbd9ed6d4910decdacea713e](https://etherscan.io/tx/0x48b82ab6b95e56504680c0c5d8b75a9a389e4619bbd9ed6d4910decdacea713e), implementations: [0xB9E397C9506F71590be1f24da3f219bedE38b845](https://etherscan.io/address/0xB9E397C9506F71590be1f24da3f219bedE38b845#code)
- 2026-04-20 21:31 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x78942254165dc0ae59b763fd30c9f472e0aca5f39ee7fa7757bdff498487ca96](https://etherscan.io/tx/0x78942254165dc0ae59b763fd30c9f472e0aca5f39ee7fa7757bdff498487ca96), implementations: [0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b](https://etherscan.io/address/0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b#code) ([diff](https://disco.l2beat.com/diff/eth:0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9/eth:0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b))
- 2026-04-20 21:31 UTC, upgrade of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0x0e1838d3baa70b38111493feb6d09029ff0f0b594ea9619c9c28b9442ff30ffb](https://etherscan.io/tx/0x0e1838d3baa70b38111493feb6d09029ff0f0b594ea9619c9c28b9442ff30ffb), implementations: [0x025f11FedA181E2Ba63bb86536DD987E0769f586](https://etherscan.io/address/0x025f11FedA181E2Ba63bb86536DD987E0769f586#code) ([diff](https://disco.l2beat.com/diff/eth:0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019/eth:0x025f11FedA181E2Ba63bb86536DD987E0769f586))
- 2026-04-20 21:31 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0xc78efc4e911d121701277a5eb494c8e74aad26a4b18f358d655e955cc7747c02](https://etherscan.io/tx/0xc78efc4e911d121701277a5eb494c8e74aad26a4b18f358d655e955cc7747c02), implementations: [0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227](https://etherscan.io/address/0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227#code) ([diff](https://disco.l2beat.com/diff/eth:0x95c76524803B8EA61c910dc0cB02B76efD6D3791/eth:0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227))
- 2026-04-20 21:30 UTC, deployment of [FastWithdrawalList](https://etherscan.io/address/0x3eFc3c84ecf259Da36E33692f2a107A0AB88D30E#code): transaction [0x78106cf05ac5ded33961c11e23dbb44bdb6f96fdec0283f55c479f57c88ebf0f](https://etherscan.io/tx/0x78106cf05ac5ded33961c11e23dbb44bdb6f96fdec0283f55c479f57c88ebf0f), implementations: [0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25](https://etherscan.io/address/0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25#code)
- 2026-04-20 21:19 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x0d5b3fa6d88af319cbae57d5dd3b53ce6749e90690ddaa2f8497d40ca19adf44](https://etherscan.io/tx/0x0d5b3fa6d88af319cbae57d5dd3b53ce6749e90690ddaa2f8497d40ca19adf44), implementations: [0x95c76524803B8EA61c910dc0cB02B76efD6D3791](https://etherscan.io/address/0x95c76524803B8EA61c910dc0cB02B76efD6D3791#code) ([diff](https://disco.l2beat.com/diff/eth:0xA0374Fa5324f4A255693Eb6B35236a21C24392f8/eth:0x95c76524803B8EA61c910dc0cB02B76efD6D3791))
- 2026-04-20 11:18 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x93a23ca29d9dbbbedbab902d37a83cad523c82d4b3ec930f5622ed508171a0e3](https://etherscan.io/tx/0x93a23ca29d9dbbbedbab902d37a83cad523c82d4b3ec930f5622ed508171a0e3), implementations: [0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd](https://etherscan.io/address/0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd#code) ([diff](https://disco.l2beat.com/diff/eth:0x46a485181ab7E0D68508b8dE306e88a3B6718193/eth:0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd))
- 2026-04-19 09:55 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x915f648035250a9982c5a9902ddc37f3c72047fa8b8fd3241ee93455d93508fa](https://etherscan.io/tx/0x915f648035250a9982c5a9902ddc37f3c72047fa8b8fd3241ee93455d93508fa), implementations: [0x46a485181ab7E0D68508b8dE306e88a3B6718193](https://etherscan.io/address/0x46a485181ab7E0D68508b8dE306e88a3B6718193#code) ([diff](https://disco.l2beat.com/diff/eth:0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f/eth:0x46a485181ab7E0D68508b8dE306e88a3B6718193))
- 2026-04-19 09:50 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x46e6634771e5902428987a7e423c9ca431fce3c7d7bf9346f213ba9c18cb247a](https://etherscan.io/tx/0x46e6634771e5902428987a7e423c9ca431fce3c7d7bf9346f213ba9c18cb247a), implementations: [0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f](https://etherscan.io/address/0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f#code) ([diff](https://disco.l2beat.com/diff/eth:0x7EafBd621Df027EbefFb7a971120b13A88710494/eth:0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f))
- 2026-04-19 09:44 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x8faf3ed7a062e5732abf80beb9c9400705745d7bbc5924c2a1523d970c655fb5](https://etherscan.io/tx/0x8faf3ed7a062e5732abf80beb9c9400705745d7bbc5924c2a1523d970c655fb5), implementations: [0x7EafBd621Df027EbefFb7a971120b13A88710494](https://etherscan.io/address/0x7EafBd621Df027EbefFb7a971120b13A88710494#code) ([diff](https://disco.l2beat.com/diff/eth:0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83/eth:0x7EafBd621Df027EbefFb7a971120b13A88710494))
- 2026-04-19 09:42 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x75ee505dc6be60d16c93c7dd6cfc33b99439de51561aed0c9fbe65e278095437](https://etherscan.io/tx/0x75ee505dc6be60d16c93c7dd6cfc33b99439de51561aed0c9fbe65e278095437), implementations: [0xA0374Fa5324f4A255693Eb6B35236a21C24392f8](https://etherscan.io/address/0xA0374Fa5324f4A255693Eb6B35236a21C24392f8#code) ([diff](https://disco.l2beat.com/diff/eth:0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA/eth:0xA0374Fa5324f4A255693Eb6B35236a21C24392f8))
- 2026-04-17 20:29 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x9a92a1828c2b689acab26e5ab139ad6faa2bec120c7462d9d3b01bffb708489a](https://etherscan.io/tx/0x9a92a1828c2b689acab26e5ab139ad6faa2bec120c7462d9d3b01bffb708489a), implementations: [0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA](https://etherscan.io/address/0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA#code) ([diff](https://disco.l2beat.com/diff/eth:0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770/eth:0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA))
- 2026-04-17 20:26 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0xae2d6f36ca6010e6405191447ffa78f5c39330e849945b4e12cb55ce112e8db1](https://etherscan.io/tx/0xae2d6f36ca6010e6405191447ffa78f5c39330e849945b4e12cb55ce112e8db1), implementations: [0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83](https://etherscan.io/address/0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83#code) ([diff](https://disco.l2beat.com/diff/eth:0x405eA6684CDD57e8f9c15395626F3c72c5255D50/eth:0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83))
- 2026-04-16 16:56 UTC, upgrade of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0xd965bd1614a8301bfb88f5bc4f6f1d3c3914df56a895ddd21c38796e03a4f790](https://etherscan.io/tx/0xd965bd1614a8301bfb88f5bc4f6f1d3c3914df56a895ddd21c38796e03a4f790), implementations: [0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019](https://etherscan.io/address/0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019#code) ([diff](https://disco.l2beat.com/diff/eth:0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e/eth:0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019))
- 2026-04-16 16:55 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x39e5b62153053ecba10153dce9d95ca2ff53e2f69f6cf7564e0369537630c8f7](https://etherscan.io/tx/0x39e5b62153053ecba10153dce9d95ca2ff53e2f69f6cf7564e0369537630c8f7), implementations: [0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9](https://etherscan.io/address/0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9#code) ([diff](https://disco.l2beat.com/diff/eth:0x8c435855E8090eB526f33f94d0474d59fD7E32A2/eth:0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9))
- 2026-04-16 16:55 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0xcf06c58c5a0a601390bb3835778a390bd0b2b25c675319feeef96a4a83940112](https://etherscan.io/tx/0xcf06c58c5a0a601390bb3835778a390bd0b2b25c675319feeef96a4a83940112), implementations: [0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770](https://etherscan.io/address/0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770#code) ([diff](https://disco.l2beat.com/diff/eth:0xF10F4D565d050BEeb9e37A548853B9c88Fd65373/eth:0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770))
- 2026-04-16 16:23 UTC, deployment of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x9280e1cd08307a30efd83b424181e0c0a377dacb4216a206b290575bf4a5edf5](https://etherscan.io/tx/0x9280e1cd08307a30efd83b424181e0c0a377dacb4216a206b290575bf4a5edf5), implementations: [0x405eA6684CDD57e8f9c15395626F3c72c5255D50](https://etherscan.io/address/0x405eA6684CDD57e8f9c15395626F3c72c5255D50#code)
- 2026-04-09 12:59 UTC, deployment of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x407471f08b665a9e9c7a6a44548270a9613093d25728e1886883f5893c75f600](https://etherscan.io/tx/0x407471f08b665a9e9c7a6a44548270a9613093d25728e1886883f5893c75f600), implementations: [0x8c435855E8090eB526f33f94d0474d59fD7E32A2](https://etherscan.io/address/0x8c435855E8090eB526f33f94d0474d59fD7E32A2#code)
- 2026-04-09 12:59 UTC, deployment of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0x7e992147bddd61de0f8c13840203f14802196eb89605508418ad4f634394143e](https://etherscan.io/tx/0x7e992147bddd61de0f8c13840203f14802196eb89605508418ad4f634394143e), implementations: [0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e](https://etherscan.io/address/0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e#code)
- 2026-04-09 12:53 UTC, deployment of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x41d58e18be407db8b25d9d8c198f42d88ef67104ae3286e1e318ec2d67b251c3](https://etherscan.io/tx/0x41d58e18be407db8b25d9d8c198f42d88ef67104ae3286e1e318ec2d67b251c3), implementations: [0xF10F4D565d050BEeb9e37A548853B9c88Fd65373](https://etherscan.io/address/0xF10F4D565d050BEeb9e37A548853B9c88Fd65373#code)

## Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-09-28 10:51 UTC](https://l2beat.com/layer2s/projects/fluent?update=762ef906) (1 change)

Upgraded TEE verification SP1 program to v1.0.7, program hash reproduced.

### [2026-09-03 10:42 UTC](https://l2beat.com/layer2s/projects/fluent?update=07424649) (1 change)

Upgraded TEE verification SP1 program to v1.0.6, program hash reproduced.

### [2026-08-26 09:55 UTC](https://l2beat.com/layer2s/projects/fluent?update=dbbe5dcb) (1 change)

Upgraded TEE verification SP1 program, program hash reproduced.

### [2026-07-24 09:10 UTC](https://l2beat.com/layer2s/projects/fluent?update=3cee2547) (1 change)

Upgraded TEE verification SP1 program, program hash reproduced.

### [2026-07-01 10:22 UTC](https://l2beat.com/layer2s/projects/fluent?update=eebf2855) (1 change)

Updated Fluent TEE program attestation verifier SP1 program to v1.0.3. Regenerated from sources.

### [2026-06-05 10:04 UTC](https://l2beat.com/layer2s/projects/fluent?update=7bf40f87) (high severity, 6 changes)

L1FluentBridge implementation swapped by FluentMultisig on 2026-05-20: `0x047A…C227` → `0xF67255…F849` ([diff](https://disco.l2beat.com/diff/eth:0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227/eth:0xF67255be817061139C9DeeA757f7276916cBF849)). Key changes:

- `receiveMessageWithProof` is now **permissionless** — the `onlyRole(RELAYER_ROLE)` gate was removed, so anyone can relay an L2→L1 message from a preconfirmed or finalized batch. `RELAYER_ROLE` no longer gates the live L1 receive path.
- Message execution gas is now bounded by `executeGasLimit` instead of `gasleft()` (`_receiveMessage(getExecuteGasLimit(), …)`); the configured limit changed 5000 → 550000, and a `ReceivedMessage(hash, success, data)` event is emitted.
- Bare ETH transfers to the bridge are rejected — the `receive() external payable {}` fallback was deleted, so ETH must go through `NativeGateway`.
- `_beforeReceiveMessage` hook gains a `bytes32 messageHash` parameter (propagated through `receiveMessageWithProof` and `receiveFailedMessage`).
- `registerGateway` now requires the target to be a contract and rejects double-registration; `unregisterGateway` rejects unknown addresses.
- `rollbackMessageWithProof` still reverts `NOT_IMPLEMENTED`.

### [2026-05-12 12:39 UTC](https://l2beat.com/layer2s/projects/fluent?update=04a3a065) (18 changes)

initial discovery

## Operator

### The system has a centralized operator

The operator is the only entity that can propose blocks. A live and trustworthy operator is vital to the health of the system. Sequencing and proof submission are also permissioned at launch: only allowlisted addresses can submit batches and SP1 proofs to the Rollup. See the Permissions section for current role holders.

**Risks**

- MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

**References**

- [Fluent Security Invariants](https://docs.fluent.xyz/system-architecture/security-invariants)

### Users can't force any transaction

There is no general mechanism to force the sequencer to include the transaction.

**Risks**

- Users can be censored if the operator refuses to include their transactions.

## Withdrawals

### Regular exit

The user initiates the withdrawal by submitting a regular transaction on this chain. When the block containing that transaction is settled the funds become available for withdrawal on L1. ZK proofs are required to settle blocks. Finally the user submits an L1 transaction to claim the funds. On Fluent, the message hash enters the block's withdrawal root which becomes part of the next batch root; once the batch is finalized, anyone can deliver the message on L1 via receiveMessageWithProof with two Merkle proofs (block-against-batch and message-against-block).

**References**

- [Fluent Bridge Architecture](https://docs.fluent.xyz/system-architecture/bridge)

### Optimistic (preconfirmed) fast withdrawals

After a batch is preconfirmed by the AWS Nitro Enclave, withdrawals can be released without waiting for finalization, subject to per-token hourly and daily caps enforced by the FastWithdrawalList registry. ETH and WETH share a bucket to prevent cap evasion.

**Risks**

- Funds can be stolen if the AWS Nitro Enclave attestation key is compromised and the operator preconfirms an invalid batch within the rate-limited window.

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/fluent

### Ethereum

#### Actors

##### FluentMultisig

Addresses: [0x33C0B99F3210a9578d81d5B13dEC03160F58ff11](https://etherscan.io/address/0x33C0B99F3210a9578d81d5B13dEC03160F58ff11)

A Multisig with 4/5 threshold.
- Can upgrade **with no delay**
  - Blacklist
  - FluentRollup
  - NativeGateway
  - L1FluentBridge
  - ERC20TokenFactory
  - ERC20Gateway
- Can interact with FluentRollup
  - grant / revoke all access control roles on the Rollup contract and configure its core parameters
  - revert non-finalized (committed or preconfirmed) batches via revertBatches; cannot revert finalized batches
- Can interact with FluentTimeLock
  - execute scheduled timelock operations once the min-delay has elapsed
- Can interact with L1FluentBridge
  - configure the rollup binding, oracles, gas parameters and gateway whitelist on the L1 bridge core, and grant / revoke its other roles
  - pause / unpause the L1 bridge core and clear expired L1->L2 deposits via skipExpiredDeposits (no user-initiated refund path exists; rollbackMessageWithProof reverts with NOT_IMPLEMENTED)

Participants (5): [0x1C07545A5EF140E2076D02a4a11cf0d7Bb172523](https://etherscan.io/address/0x1C07545A5EF140E2076D02a4a11cf0d7Bb172523), [0x9ec3f0d76A6d3847d86374c791C6E170CAd9518D](https://l2beat.com/layer2s/projects/fluent#FluentAdminEOA) (FluentAdminEOA), [0x6845b3A6B1b8071944D20a797D57F4c0b8E3f99b](https://etherscan.io/address/0x6845b3A6B1b8071944D20a797D57F4c0b8E3f99b), [0x624Cd730EE0f49c51a150b6e29Ae833DfE2B0C9B](https://etherscan.io/address/0x624Cd730EE0f49c51a150b6e29Ae833DfE2B0C9B), [0x9CDFcAB50663169Dcd99597815472E2494f09Fa0](https://etherscan.io/address/0x9CDFcAB50663169Dcd99597815472E2494f09Fa0)

##### ERC20TokenFactory

Addresses: [0xF6d49E874Cb64b8ee56D6F99BD340134B30AB225](https://etherscan.io/address/0xF6d49E874Cb64b8ee56D6F99BD340134B30AB225)

- Can interact with UpgradeableBeacon
  - change the beacon implementation

##### SP1VerifierGatewayMultisig

Addresses: [0xCafEf00d348Adbd57c37d1B77e0619C6244C6878](https://etherscan.io/address/0xCafEf00d348Adbd57c37d1B77e0619C6244C6878)

A Multisig with 2/3 threshold.
- Can interact with SP1VerifierGatewayOlder
  - affect the liveness and safety of the gateway - can transfer ownership, add and freeze verifier routes

Participants (3): [0xBaB2c2aF5b91695e65955DA60d63aD1b2aE81126](https://etherscan.io/address/0xBaB2c2aF5b91695e65955DA60d63aD1b2aE81126), [0x72Ff26D9517324eEFA89A48B75c5df41132c4f54](https://etherscan.io/address/0x72Ff26D9517324eEFA89A48B75c5df41132c4f54), [0x9395e83720bf2D8ac6435f9c520b48E289Cb8885](https://etherscan.io/address/0x9395e83720bf2D8ac6435f9c520b48E289Cb8885)

Used in: [Celo](https://l2beat.com/layer2s/projects/celo#SP1VerifierGatewayMultisig), [Lens](https://l2beat.com/layer2s/projects/lens#SP1VerifierGatewayMultisig), [Mantle](https://l2beat.com/layer2s/projects/mantle#SP1VerifierGatewayMultisig), [RISE](https://l2beat.com/layer2s/projects/rise#SP1VerifierGatewayMultisig), [Sophon](https://l2beat.com/layer2s/projects/sophon#SP1VerifierGatewayMultisig), [Taiko Alethia](https://l2beat.com/layer2s/projects/taiko#SP1VerifierGatewayMultisig), [X Layer](https://l2beat.com/layer2s/projects/xlayer#SP1VerifierGatewayMultisig)

##### FluentAdminEOA

Addresses: [0x9ec3f0d76A6d3847d86374c791C6E170CAd9518D](https://etherscan.io/address/0x9ec3f0d76A6d3847d86374c791C6E170CAd9518D)

Member of FluentMultisig.
- Can interact with FluentTimeLock
  - cancel scheduled timelock operations before they are executed
  - schedule operations on the timelock; the configured min-delay must elapse before they can be executed

##### FluentProverEOA

Addresses: [0xB9E6f78a0F35F96b806D0359AbB251117aCe255C](https://etherscan.io/address/0xB9E6f78a0F35F96b806D0359AbB251117aCe255C)

- Can interact with FluentRollup
  - submit SP1 ZK proofs that resolve challenged batches and accelerate finalization via finalizeWithProofs

##### FluentEnclaveAttesterEOA

Addresses: [0xef9Dc1F87BAA090a35B985DAad9c8096440F2012](https://etherscan.io/address/0xef9Dc1F87BAA090a35B985DAad9c8096440F2012)

- Can interact with FluentRollup
  - AWS Nitro Enclave attestation key admitted to preconfirm batches; binds the optimistic fast-withdrawal path

##### FluentSequencerEOA

Addresses: [0xFd58Bc438d910088C413b889Eaa0aded5C0d1c26](https://etherscan.io/address/0xFd58Bc438d910088C413b889Eaa0aded5C0d1c26)

- Can interact with FluentRollup
  - commit batches and submit EIP-4844 blob hashes to the Rollup

## Smart contracts

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/fluent

### Ethereum

#### FastWithdrawalList

Addresses: [0x3eFc3c84ecf259Da36E33692f2a107A0AB88D30E](https://etherscan.io/address/0x3eFc3c84ecf259Da36E33692f2a107A0AB88D30E#code), [0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25](https://etherscan.io/address/0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2026-04-20 21:30 UTC, deployment of [FastWithdrawalList](https://etherscan.io/address/0x3eFc3c84ecf259Da36E33692f2a107A0AB88D30E#code): transaction [0x78106cf05ac5ded33961c11e23dbb44bdb6f96fdec0283f55c479f57c88ebf0f](https://etherscan.io/tx/0x78106cf05ac5ded33961c11e23dbb44bdb6f96fdec0283f55c479f57c88ebf0f), implementations: [0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25](https://etherscan.io/address/0x94F068ee9A23F3F883bdE060502a46E9C4EeAb25#code)

Per-token rate-limit registry for the optimistic (preconfirmed) fast-withdrawal path. Enforces hourly and daily caps using rolling windows keyed by block timestamp; related tokens (e.g. ETH and WETH) can be aliased to a shared bucket to prevent cap evasion.

#### NativeGateway

Addresses: [0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code), [0x025f11FedA181E2Ba63bb86536DD987E0769f586](https://etherscan.io/address/0x025f11FedA181E2Ba63bb86536DD987E0769f586#code) (Implementation (Upgradable)), [0x33C0B99F3210a9578d81d5B13dEC03160F58ff11](https://etherscan.io/address/0x33C0B99F3210a9578d81d5B13dEC03160F58ff11#code) (Admin)

**Past upgrades** (Count of upgrades: 2, Last upgrade: 5mo 28d ago, Avg upgrade interval: 2mo 3d)

- 2026-04-20 21:31 UTC, upgrade of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0x0e1838d3baa70b38111493feb6d09029ff0f0b594ea9619c9c28b9442ff30ffb](https://etherscan.io/tx/0x0e1838d3baa70b38111493feb6d09029ff0f0b594ea9619c9c28b9442ff30ffb), implementations: [0x025f11FedA181E2Ba63bb86536DD987E0769f586](https://etherscan.io/address/0x025f11FedA181E2Ba63bb86536DD987E0769f586#code) ([diff](https://disco.l2beat.com/diff/eth:0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019/eth:0x025f11FedA181E2Ba63bb86536DD987E0769f586))
- 2026-04-16 16:56 UTC, upgrade of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0xd965bd1614a8301bfb88f5bc4f6f1d3c3914df56a895ddd21c38796e03a4f790](https://etherscan.io/tx/0xd965bd1614a8301bfb88f5bc4f6f1d3c3914df56a895ddd21c38796e03a4f790), implementations: [0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019](https://etherscan.io/address/0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019#code) ([diff](https://disco.l2beat.com/diff/eth:0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e/eth:0xbA3d3B60b6f462AA3fb2D63F8B610Fa8825c3019))
- 2026-04-09 12:59 UTC, deployment of [NativeGateway](https://etherscan.io/address/0x8976Ca4E0c8467097Da675399fB7DB454a1b56dd#code): transaction [0x7e992147bddd61de0f8c13840203f14802196eb89605508418ad4f634394143e](https://etherscan.io/tx/0x7e992147bddd61de0f8c13840203f14802196eb89605508418ad4f634394143e), implementations: [0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e](https://etherscan.io/address/0x482Df12fbc3BA7A7f02Aa928e620fd12aF5Fd30e#code)

L1 entry point for ETH deposits into Fluent. Forwards ETH to L1FluentBridge for actual escrow custody and emits the corresponding bridge message. UUPS-upgradeable; upgrades are gated by the contract owner.
- Roles:
  - **admin**: FluentMultisig

Can be upgraded by: FluentMultisig with no delay

#### L1FluentBridge (escrow)

Addresses: [0x9CAcf613fC29015893728563f423fD26dCdB8Ddc](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code), [0xF67255be817061139C9DeeA757f7276916cBF849](https://etherscan.io/address/0xF67255be817061139C9DeeA757f7276916cBF849#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin)

**Past upgrades** (Count of upgrades: 6, Last upgrade: 4mo 28d ago, Avg upgrade interval: 27d 2h)

- 2026-05-20 15:00 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x5683f1be2880db1238db0cafc17623f895de685541543b5fd577efdfec53429c](https://etherscan.io/tx/0x5683f1be2880db1238db0cafc17623f895de685541543b5fd577efdfec53429c), implementations: [0xF67255be817061139C9DeeA757f7276916cBF849](https://etherscan.io/address/0xF67255be817061139C9DeeA757f7276916cBF849#code) ([diff](https://disco.l2beat.com/diff/eth:0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227/eth:0xF67255be817061139C9DeeA757f7276916cBF849))
- 2026-04-20 21:31 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0xc78efc4e911d121701277a5eb494c8e74aad26a4b18f358d655e955cc7747c02](https://etherscan.io/tx/0xc78efc4e911d121701277a5eb494c8e74aad26a4b18f358d655e955cc7747c02), implementations: [0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227](https://etherscan.io/address/0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227#code) ([diff](https://disco.l2beat.com/diff/eth:0x95c76524803B8EA61c910dc0cB02B76efD6D3791/eth:0x047AaDf25df7D17bB5B6b1FF31cecD1E4973C227))
- 2026-04-20 21:19 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x0d5b3fa6d88af319cbae57d5dd3b53ce6749e90690ddaa2f8497d40ca19adf44](https://etherscan.io/tx/0x0d5b3fa6d88af319cbae57d5dd3b53ce6749e90690ddaa2f8497d40ca19adf44), implementations: [0x95c76524803B8EA61c910dc0cB02B76efD6D3791](https://etherscan.io/address/0x95c76524803B8EA61c910dc0cB02B76efD6D3791#code) ([diff](https://disco.l2beat.com/diff/eth:0xA0374Fa5324f4A255693Eb6B35236a21C24392f8/eth:0x95c76524803B8EA61c910dc0cB02B76efD6D3791))
- 2026-04-19 09:42 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x75ee505dc6be60d16c93c7dd6cfc33b99439de51561aed0c9fbe65e278095437](https://etherscan.io/tx/0x75ee505dc6be60d16c93c7dd6cfc33b99439de51561aed0c9fbe65e278095437), implementations: [0xA0374Fa5324f4A255693Eb6B35236a21C24392f8](https://etherscan.io/address/0xA0374Fa5324f4A255693Eb6B35236a21C24392f8#code) ([diff](https://disco.l2beat.com/diff/eth:0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA/eth:0xA0374Fa5324f4A255693Eb6B35236a21C24392f8))
- 2026-04-17 20:29 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x9a92a1828c2b689acab26e5ab139ad6faa2bec120c7462d9d3b01bffb708489a](https://etherscan.io/tx/0x9a92a1828c2b689acab26e5ab139ad6faa2bec120c7462d9d3b01bffb708489a), implementations: [0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA](https://etherscan.io/address/0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA#code) ([diff](https://disco.l2beat.com/diff/eth:0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770/eth:0xfF0Ef75C7a2942294A5a828b1c11F7aF618De4cA))
- 2026-04-16 16:55 UTC, upgrade of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0xcf06c58c5a0a601390bb3835778a390bd0b2b25c675319feeef96a4a83940112](https://etherscan.io/tx/0xcf06c58c5a0a601390bb3835778a390bd0b2b25c675319feeef96a4a83940112), implementations: [0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770](https://etherscan.io/address/0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770#code) ([diff](https://disco.l2beat.com/diff/eth:0xF10F4D565d050BEeb9e37A548853B9c88Fd65373/eth:0x52f9e37FeDd9EF7d5eCB24D77cff40d5337A5770))
- 2026-04-09 12:53 UTC, deployment of [L1FluentBridge](https://etherscan.io/address/0x9CAcf613fC29015893728563f423fD26dCdB8Ddc#code): transaction [0x41d58e18be407db8b25d9d8c198f42d88ef67104ae3286e1e318ec2d67b251c3](https://etherscan.io/tx/0x41d58e18be407db8b25d9d8c198f42d88ef67104ae3286e1e318ec2d67b251c3), implementations: [0xF10F4D565d050BEeb9e37A548853B9c88Fd65373](https://etherscan.io/address/0xF10F4D565d050BEeb9e37A548853B9c88Fd65373#code)

Bridge core for Fluent. Routes deposits from L1 gateways into a FIFO queue consumed by the sequencer, and lets anyone process L2->L1 messages with two Merkle proofs against a preconfirmed or finalized batch root. Custodies bridged ETH on L1 (gateways forward ETH here on deposit). UUPS-upgradeable; upgrades and gateway-whitelist / oracle / pause changes are gated by DEFAULT_ADMIN_ROLE.
- Roles:
  - **defaultAdmin**: FluentMultisig
  - **pauser**: FluentMultisig

The following tokens are included in the value secured calculation: ETH

Can be upgraded by: FluentMultisig with no delay

#### ERC20Gateway (escrow)

Addresses: [0xFD4C62647A34FF6d6802092F5fbe176099223B61](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code), [0x81e1158368bD28Cc6E8380852087a9512A9670fB](https://etherscan.io/address/0x81e1158368bD28Cc6E8380852087a9512A9670fB#code) (Implementation (Upgradable)), [0x33C0B99F3210a9578d81d5B13dEC03160F58ff11](https://etherscan.io/address/0x33C0B99F3210a9578d81d5B13dEC03160F58ff11#code) (Admin)

**Past upgrades** (Count of upgrades: 3, Last upgrade: 5mo 26d ago, Avg upgrade interval: 1mo 17d)

- 2026-04-23 01:38 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x2625ebb9ea1e887805cc22e6d221a6e13f79d0db0b5acac9815e3231d39b0ce6](https://etherscan.io/tx/0x2625ebb9ea1e887805cc22e6d221a6e13f79d0db0b5acac9815e3231d39b0ce6), implementations: [0x81e1158368bD28Cc6E8380852087a9512A9670fB](https://etherscan.io/address/0x81e1158368bD28Cc6E8380852087a9512A9670fB#code) ([diff](https://disco.l2beat.com/diff/eth:0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b/eth:0x81e1158368bD28Cc6E8380852087a9512A9670fB))
- 2026-04-20 21:31 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x78942254165dc0ae59b763fd30c9f472e0aca5f39ee7fa7757bdff498487ca96](https://etherscan.io/tx/0x78942254165dc0ae59b763fd30c9f472e0aca5f39ee7fa7757bdff498487ca96), implementations: [0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b](https://etherscan.io/address/0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b#code) ([diff](https://disco.l2beat.com/diff/eth:0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9/eth:0xe1Cf59617A333eaCEAF36BE03cB0b94A250acf4b))
- 2026-04-16 16:55 UTC, upgrade of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x39e5b62153053ecba10153dce9d95ca2ff53e2f69f6cf7564e0369537630c8f7](https://etherscan.io/tx/0x39e5b62153053ecba10153dce9d95ca2ff53e2f69f6cf7564e0369537630c8f7), implementations: [0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9](https://etherscan.io/address/0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9#code) ([diff](https://disco.l2beat.com/diff/eth:0x8c435855E8090eB526f33f94d0474d59fD7E32A2/eth:0x5398c8De96Ef049B5d8D0ce01e4C9D58c47B98C9))
- 2026-04-09 12:59 UTC, deployment of [ERC20Gateway](https://etherscan.io/address/0xFD4C62647A34FF6d6802092F5fbe176099223B61#code): transaction [0x407471f08b665a9e9c7a6a44548270a9613093d25728e1886883f5893c75f600](https://etherscan.io/tx/0x407471f08b665a9e9c7a6a44548270a9613093d25728e1886883f5893c75f600), implementations: [0x8c435855E8090eB526f33f94d0474d59fD7E32A2](https://etherscan.io/address/0x8c435855E8090eB526f33f94d0474d59fD7E32A2#code)

L1 entry point for ERC-20 deposits into Fluent. Custodies ERC-20 tokens directly on L1 and emits the corresponding bridge message; on the L2 side the canonical pegged token is minted via the ERC20TokenFactory. UUPS-upgradeable; upgrades are gated by the contract owner.
- Roles:
  - **admin**: FluentMultisig

All supported tokens in this escrow are included in the value secured calculation.

Can be upgraded by: FluentMultisig with no delay

#### FluentTimeLock

Addresses: [0x7846C001835d889A29ba659f67A5B7ac98E73bF4](https://etherscan.io/address/0x7846C001835d889A29ba659f67A5B7ac98E73bF4#code)

OpenZeppelin TimelockController used to delay privileged operations. PROPOSER_ROLE schedules calls; the configured minimum delay must elapse before EXECUTOR_ROLE can execute them; CANCELLER_ROLE can drop scheduled calls.
- Roles:
  - **canceller**: FluentAdminEOA
  - **executor**: FluentMultisig
  - **proposer**: FluentAdminEOA

#### ERC20PeggedToken

Addresses: [0x056fD0A3eD85c6ae1Ec1c398B33581951Ed4b090](https://etherscan.io/address/0x056fD0A3eD85c6ae1Ec1c398B33581951Ed4b090#code)

#### Blacklist

Addresses: [0x05C5d46a5e6f92fB9CdA9A8b03E4440A175D1484](https://etherscan.io/address/0x05C5d46a5e6f92fB9CdA9A8b03E4440A175D1484#code), [0xB9E397C9506F71590be1f24da3f219bedE38b845](https://etherscan.io/address/0xB9E397C9506F71590be1f24da3f219bedE38b845#code) (Implementation (Upgradable)), [0x33C0B99F3210a9578d81d5B13dEC03160F58ff11](https://etherscan.io/address/0x33C0B99F3210a9578d81d5B13dEC03160F58ff11#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2026-04-20 21:35 UTC, deployment of [Blacklist](https://etherscan.io/address/0x05C5d46a5e6f92fB9CdA9A8b03E4440A175D1484#code): transaction [0x48b82ab6b95e56504680c0c5d8b75a9a389e4619bbd9ed6d4910decdacea713e](https://etherscan.io/tx/0x48b82ab6b95e56504680c0c5d8b75a9a389e4619bbd9ed6d4910decdacea713e), implementations: [0xB9E397C9506F71590be1f24da3f219bedE38b845](https://etherscan.io/address/0xB9E397C9506F71590be1f24da3f219bedE38b845#code)

- Roles:
  - **admin**: FluentMultisig

Can be upgraded by: FluentMultisig with no delay

#### FluentRollup

Addresses: [0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code), [0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1](https://etherscan.io/address/0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin)

**Past upgrades** (Count of upgrades: 6, Last upgrade: 5mo 26d ago, Avg upgrade interval: 26d 2h)

- 2026-04-22 16:35 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x656d50f10e86f6bbee1bd4c39258cc2ebf75341d74be55c3163b7ed990c931b6](https://etherscan.io/tx/0x656d50f10e86f6bbee1bd4c39258cc2ebf75341d74be55c3163b7ed990c931b6), implementations: [0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1](https://etherscan.io/address/0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1#code) ([diff](https://disco.l2beat.com/diff/eth:0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd/eth:0xF6ad498c8B9bfbD2F26EcD9665aC71d9032245c1))
- 2026-04-20 11:18 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x93a23ca29d9dbbbedbab902d37a83cad523c82d4b3ec930f5622ed508171a0e3](https://etherscan.io/tx/0x93a23ca29d9dbbbedbab902d37a83cad523c82d4b3ec930f5622ed508171a0e3), implementations: [0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd](https://etherscan.io/address/0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd#code) ([diff](https://disco.l2beat.com/diff/eth:0x46a485181ab7E0D68508b8dE306e88a3B6718193/eth:0xf7EEe2D42f70DCacE0a6E368099A9EBCcaB74Efd))
- 2026-04-19 09:55 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x915f648035250a9982c5a9902ddc37f3c72047fa8b8fd3241ee93455d93508fa](https://etherscan.io/tx/0x915f648035250a9982c5a9902ddc37f3c72047fa8b8fd3241ee93455d93508fa), implementations: [0x46a485181ab7E0D68508b8dE306e88a3B6718193](https://etherscan.io/address/0x46a485181ab7E0D68508b8dE306e88a3B6718193#code) ([diff](https://disco.l2beat.com/diff/eth:0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f/eth:0x46a485181ab7E0D68508b8dE306e88a3B6718193))
- 2026-04-19 09:50 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x46e6634771e5902428987a7e423c9ca431fce3c7d7bf9346f213ba9c18cb247a](https://etherscan.io/tx/0x46e6634771e5902428987a7e423c9ca431fce3c7d7bf9346f213ba9c18cb247a), implementations: [0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f](https://etherscan.io/address/0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f#code) ([diff](https://disco.l2beat.com/diff/eth:0x7EafBd621Df027EbefFb7a971120b13A88710494/eth:0x5E0D546dAdE979c9eEE458Cc8b6212E53921889f))
- 2026-04-19 09:44 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x8faf3ed7a062e5732abf80beb9c9400705745d7bbc5924c2a1523d970c655fb5](https://etherscan.io/tx/0x8faf3ed7a062e5732abf80beb9c9400705745d7bbc5924c2a1523d970c655fb5), implementations: [0x7EafBd621Df027EbefFb7a971120b13A88710494](https://etherscan.io/address/0x7EafBd621Df027EbefFb7a971120b13A88710494#code) ([diff](https://disco.l2beat.com/diff/eth:0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83/eth:0x7EafBd621Df027EbefFb7a971120b13A88710494))
- 2026-04-17 20:26 UTC, upgrade of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0xae2d6f36ca6010e6405191447ffa78f5c39330e849945b4e12cb55ce112e8db1](https://etherscan.io/tx/0xae2d6f36ca6010e6405191447ffa78f5c39330e849945b4e12cb55ce112e8db1), implementations: [0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83](https://etherscan.io/address/0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83#code) ([diff](https://disco.l2beat.com/diff/eth:0x405eA6684CDD57e8f9c15395626F3c72c5255D50/eth:0x76Ec5c71FF385b2E174f1191589a7368eE9d7C83))
- 2026-04-16 16:23 UTC, deployment of [FluentRollup](https://etherscan.io/address/0x1cF53Fd9CD0b713be29F2b41cA17A943f138727f#code): transaction [0x9280e1cd08307a30efd83b424181e0c0a377dacb4216a206b290575bf4a5edf5](https://etherscan.io/tx/0x9280e1cd08307a30efd83b424181e0c0a377dacb4216a206b290575bf4a5edf5), implementations: [0x405eA6684CDD57e8f9c15395626F3c72c5255D50](https://etherscan.io/address/0x405eA6684CDD57e8f9c15395626F3c72c5255D50#code)

Core Fluent rollup contract. Sequencers commit batch roots and EIP-4844 blob hashes; an AWS Nitro Enclave preconfirms each batch via a signature whose key is bound to a PCR0 measurement verified by SP1; participants holding CHALLENGER_ROLE can dispute and the prover resolves disputes with SP1 ZK proofs; batches finalize after a block-count delay or immediately once all blocks are proven.
- Roles:
  - **defaultAdmin**: FluentMultisig
  - **emergency**: FluentMultisig
  - **preconfirmation**: FluentEnclaveAttesterEOA
  - **prover**: FluentProverEOA
  - **sequencer**: FluentSequencerEOA

Can be upgraded by: FluentMultisig with no delay

#### NitroVerifier (2 instances)

Addresses: [0x207FBb4AC5227Ab598B8072BdC1E150dF687AC5B](https://etherscan.io/address/0x207FBb4AC5227Ab598B8072BdC1E150dF687AC5B#code), [0xFdB04b67ecD8352bA3885F66fFfddf1f5f25292F](https://etherscan.io/address/0xFdB04b67ecD8352bA3885F66fFfddf1f5f25292F#code)

Verifies AWS Nitro Enclave attestations onchain. The enclave's signing key is admitted only after an SP1 proof confirms its attestation matches the expected PCR0 measurement, binding preconfirmation authority to audited enclave code.

#### UpgradeableBeacon

Addresses: [0xdD283a04cc711aB9c08d79e665835821BEef710B](https://etherscan.io/address/0xdD283a04cc711aB9c08d79e665835821BEef710B#code)

A beacon with an upgradeable implementation currently set as ERC20PeggedToken. Beacon proxy contracts pointing to this beacon will all use its implementation.
- Roles:
  - **owner**: ERC20TokenFactory

#### SP1VerifierGatewayOlder

Addresses: [0x397A5f7f3dBd538f23DE225B51f532c34448dA9B](https://etherscan.io/address/0x397A5f7f3dBd538f23DE225B51f532c34448dA9B#code)

This contract is the router for zk proof verification. It stores the mapping between identifiers and the address of onchain verifier contracts, routing each identifier to the corresponding verifier contract.
- Roles:
  - **owner**: SP1VerifierGatewayMultisig

Implementation used in: [X Layer](https://l2beat.com/layer2s/projects/xlayer#SP1VerifierGatewayOlder)

#### SP1Verifier

Addresses: [0xb69f2584CBcFf99a58C4e7002E8b89Af54a6f4e2](https://etherscan.io/address/0xb69f2584CBcFf99a58C4e7002E8b89Af54a6f4e2#code)

Verifier contract for SP1 proofs (v6.1.0).

Implementation used in: [X Layer](https://l2beat.com/layer2s/projects/xlayer#SP1Verifier)

The current deployment carries some associated risks:

- Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

### Program Hashes

#### Fluent STF guest program

Guest program implementing state transition function of the Fluent rollup

- Hash: `0x00e34107e4c5284bd4ecc4269c650671038c1e85d9dacb931b534e984f607334`
- Repository: code unknown
- Verification: unsuccessful
- Used in: [Fluent](https://l2beat.com/layer2s/projects/fluent)

##### Verification steps

According to the Fluent team, the sources for this program were not yet published. Thus it cannot be verified.

#### Fluent Nitro TEE verifier v1.0.7

Verifies correctness of a single TEE attestation for executing Fluent STF within a trusted enclave on AWS cloud.

- Hash: `0x00f291835495d0af627923c963f18395bb9a7e6783b694497460f757866ea34b`
- Repository: https://github.com/fluentlabs-xyz/fluent-stf/tree/v1.0.7/bin/aws-nitro-validator
- Verification: successful
- Used in: [Fluent](https://l2beat.com/layer2s/projects/fluent)

##### Verification steps

Regeneration steps are based on [this guide](https://github.com/fluentlabs-xyz/fluent-stf/blob/v1.0.7/README.md). The process is reproducible on a Linux x86_64 (amd64) machine.

1. Install prerequesits: `docker`, `python3`, `git`, `jq`.
2. Checkout correct branch in https://github.com/fluentlabs-xyz/fluent-stf/tree/v1.0.7: `git checkout v1.0.7`. Commit hash should be `7e4db8ca602c93fa54f831a4de49b0285fc3ad18`.
3. Build Nitro program for the mainnet within docker: `make build-nitro-validator-docker NETWORK=mainnet`. This command will create `nitro-validator-mainnet.vkey` file with the program hash string.