# Shibarium

Markdown version of https://l2beat.com/layer2s/projects/shibarium

## Summary

**Warning:** Critical contracts can be upgraded by an EOA which could result in the loss of all funds.

**Warning:** Why is the project listed in others? The proof system isn't fully functional. Consequence: projects without a proper proof system fully rely on single entities to safely update the state. A malicious proposer can finalize an invalid state, which can cause loss of funds. There is no data availability bridge. Consequence: projects without a data availability bridge fully rely on single entities (the sequencer) to honestly rely available data roots on Ethereum. A malicious sequencer can collude with the proposer to finalize an unavailable state, which can cause loss of funds. Learn more about the [recategorisation](https://medium.com/l2beat/framework-update-l2-projects-recategorisation-5d43b0d1fe50).

- Total Value Secured: $716.79 K (-8.15% compared to seven days ago; canonically bridged $716.79 K, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge)
  - **Warning:** The SHIB, BONE and LEASH tokens associated with Shibarium account for 99.2% of the TVS! (sentiment: bad)
- TVS by asset: ETH & derivatives $4.71 K (0.65%), Stablecoins $38.93 (0.00%), BTC & derivatives $0.09 (0.00%), Other $712.04 K (99.3%)
- Associated tokens: SHIB, BONE, LEASH: $711.77 K (99.2% of TVS)
- Past day UOPS: No data
- Type: Other
- Purpose: Universal
- Host chain: Ethereum
- Chain ID: 109

### Risks

- Sequencer failure: Enqueue via L1 (sentiment: warning)
- State validation: None (sentiment: bad)
- Data availability: External (DAC) (sentiment: bad)
- Exit window: None (sentiment: bad)
- Proposer failure: Cannot withdraw (sentiment: bad)

### About

Shibarium is an EVM-compatible, proof of stake sidechain for Ethereum. It is built by developers behind the Shiba Inu token ecosystem. The main bridge to Ethereum is currently validated by Shibarium validators and allows for asset as well as data movement between Shibarium and Ethereum.

### Links

- Website: https://shibarium.shib.io/
- Bridge: https://shibarium.shib.io/bridge
- Docs: https://docs.shib.io/docs/shibarium/welcome/welcome-overview
- Explorer: https://shibariumscan.io/
- Repository: https://github.com/shibaone
- Social: https://x.com/ShibariumNet, https://discord.com/invite/shibariumtech, https://x.com/shibtoken, https://blog.shib.io/, https://t.me/ShibariumTechnologies
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/shibarium

### Badges

- EVM: This project uses the Ethereum Virtual Machine to run its smart contracts and supports the Solidity programming language
- Custom DA solution: This project is using a custom DA solution

## Value Secured

The interactive TVS charts are shown on [the HTML page](https://l2beat.com/layer2s/projects/shibarium#tvs).

Token by token: [TVS breakdown](https://l2beat.com/layer2s/projects/shibarium/tvs-breakdown).

- [TVS chart (JSON)](https://l2beat.com/api/scaling/tvs/shibarium)
- [TVS breakdown by token (JSON)](https://l2beat.com/api/scaling/tvs/shibarium/breakdown)

## Milestones & Incidents

- 2025-09-12 (incident): [Shibarium bridge exploited](https://x.com/Shibtoken/status/1966845298774278444). Keys of 10/12 Shibarium validators compromised - malicious chain root state used to steal funds.

## Risk summary

### Funds can be stolen if

1. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
2. validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum,
3. validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

### Users can be censored if

4. validators on Shibarium decide to not mint tokens after observing an event on Ethereum.

## Risk analysis

**Warning:** Critical contracts can be upgraded by an EOA which could result in the loss of all funds.

### Sequencer failure

Enqueue via L1 (sentiment: warning)

Users can submit transactions to an L1 queue, but can't force them. The sequencers cannot selectively skip transactions but can stop processing the queue entirely. In other words, if the sequencers censor or are down, they are so for everyone.

### State validation

None (sentiment: bad)

Currently the system permits invalid state roots. More details in project overview.

### Data availability

External (DAC) (sentiment: bad)

Proof construction relies fully on data that is NOT published onchain. There exists a Data Availability Committee (DAC) with a threshold of 8/11 that is tasked with protecting and supplying the data.

### Exit window

None (sentiment: bad)

There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

### Proposer failure

Cannot withdraw (sentiment: bad)

Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen.

## State validation

### No state validation

As a fork of Polygon PoS, state updates are settled if signed by at least 2/3+1 of the Shibarium validators stake, without checking whether the state transition is valid. The validator set is gated by a whitelist, which is not public.

**Risks**

- Users can be censored if validators on Shibarium decide to not mint tokens after observing an event on Ethereum.
- Funds can be stolen if validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum.
- Funds can be stolen if validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

## Upgrades & Governance

### Past upgrades

The metrics include upgrades on the currently used proxy contracts. Historical proxy contracts and changes of such are not included.

- Count of upgrades: 6
- Last upgrade: 1y ago
- Avg upgrade interval: 7mo 21d

- 2025-09-24 19:46 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xa214ba95a5640e38fdbae0e1e9fb12b38fea89906efa333f37ae2f65d56bfd7c](https://etherscan.io/tx/0xa214ba95a5640e38fdbae0e1e9fb12b38fea89906efa333f37ae2f65d56bfd7c), implementations: [0x269C0ebb7a39995dB531Ccd61D015e431530b87A](https://etherscan.io/address/0x269C0ebb7a39995dB531Ccd61D015e431530b87A#code) ([diff](https://disco.l2beat.com/diff/eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207/eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A))
- 2025-09-13 06:40 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xb29de7fcedb239478107bc733122b48e0b61a6b9c65dee54284eff1c20f5ebf3](https://etherscan.io/tx/0xb29de7fcedb239478107bc733122b48e0b61a6b9c65dee54284eff1c20f5ebf3), implementations: [0x94e5C17983cf1631e7135C33CF0e6206FF995207](https://etherscan.io/address/0x94e5C17983cf1631e7135C33CF0e6206FF995207#code) ([diff](https://disco.l2beat.com/diff/eth:0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580/eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207))
- 2025-09-13 00:57 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x474dad78a461d4a14303b22644ee0187662be48801886610b267f828cf1e163e](https://etherscan.io/tx/0x474dad78a461d4a14303b22644ee0187662be48801886610b267f828cf1e163e), implementations: [0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580](https://etherscan.io/address/0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580#code) ([diff](https://disco.l2beat.com/diff/eth:0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6/eth:0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580))
- 2025-09-12 23:15 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xd279065a7d358769b5ad90287789af79eadc3575d56c97f69ffe723e42da2ee6](https://etherscan.io/tx/0xd279065a7d358769b5ad90287789af79eadc3575d56c97f69ffe723e42da2ee6), implementations: [0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6](https://etherscan.io/address/0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6#code) ([diff](https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6))
- 2024-11-30 00:34 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x3278cdbe9d195ccb8cdc22c3c3613affb1b4ce5f01daf4eea713d29b49b6e5a7](https://etherscan.io/tx/0x3278cdbe9d195ccb8cdc22c3c3613affb1b4ce5f01daf4eea713d29b49b6e5a7), implementations: [0x1be79AED4088A55f5ED249a14f777758d9F888c6](https://etherscan.io/address/0x1be79AED4088A55f5ED249a14f777758d9F888c6#code) ([diff](https://disco.l2beat.com/diff/eth:0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6))
- 2024-11-29 21:10 UTC, deployment of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x80b2df040001f763336e32a7a1784fe5af6b8a9645d79f9f28e2a53e6b76eece](https://etherscan.io/tx/0x80b2df040001f763336e32a7a1784fe5af6b8a9645d79f9f28e2a53e6b76eece), implementations: [0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584](https://etherscan.io/address/0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584#code)
- 2024-10-09 16:29 UTC, upgrade of [ERC721Predicate](https://etherscan.io/address/0x98C831cFB18852f7deB3E3a970e907475b49730f#code): transaction [0x0773a0a64bcceb0d4fba20aa39483ea08f1cd58b39899640e8a2c161253f53c5](https://etherscan.io/tx/0x0773a0a64bcceb0d4fba20aa39483ea08f1cd58b39899640e8a2c161253f53c5), implementations: [0xe0f4555Fcffb181B1D7566d89200105226F29580](https://etherscan.io/address/0xe0f4555Fcffb181B1D7566d89200105226F29580#code) ([diff](https://disco.l2beat.com/diff/eth:0x67281E19c31B19f5450d1F218AA29e036C606fC0/eth:0xe0f4555Fcffb181B1D7566d89200105226F29580))
- 2023-08-08 06:26 UTC, deployment of [EtherPredicate](https://etherscan.io/address/0xc3897302aB4B42931cB4857050Fa60f53B775870#code): transaction [0x8a1a09d34137ce9d1fa93b6bbfb9312d8cd7c7141a440cee55bd54a2fda93584](https://etherscan.io/tx/0x8a1a09d34137ce9d1fa93b6bbfb9312d8cd7c7141a440cee55bd54a2fda93584), implementations: [0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA](https://etherscan.io/address/0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA#code)
- 2023-08-08 06:25 UTC, deployment of [ERC1155Predicate](https://etherscan.io/address/0x0057bed57066F61c64DACB395B38c6E1792e03B8#code): transaction [0xee350a63a70b71d85dca0d0154a14b13d67f3b48a11857fcf938cddfe26a8a99](https://etherscan.io/tx/0xee350a63a70b71d85dca0d0154a14b13d67f3b48a11857fcf938cddfe26a8a99), implementations: [0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610](https://etherscan.io/address/0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610#code)
- 2023-08-08 06:23 UTC, deployment of [MintableERC721Predicate](https://etherscan.io/address/0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665#code): transaction [0xb4b02d47286a8569107dcbb8d73af8ab2e897abad6a70f1718fd60222e4a2922](https://etherscan.io/tx/0xb4b02d47286a8569107dcbb8d73af8ab2e897abad6a70f1718fd60222e4a2922), implementations: [0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b](https://etherscan.io/address/0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b#code)
- 2023-08-08 06:21 UTC, deployment of [ERC721Predicate](https://etherscan.io/address/0x98C831cFB18852f7deB3E3a970e907475b49730f#code): transaction [0x2c4200e203ff16184501a19029fcc02264538e65e74e96d142010ebe5a7fcf58](https://etherscan.io/tx/0x2c4200e203ff16184501a19029fcc02264538e65e74e96d142010ebe5a7fcf58), implementations: [0x67281E19c31B19f5450d1F218AA29e036C606fC0](https://etherscan.io/address/0x67281E19c31B19f5450d1F218AA29e036C606fC0#code)
- 2023-08-08 06:19 UTC, deployment of [ERC20Predicate](https://etherscan.io/address/0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa#code): transaction [0x0200b66f31756427a0c3d6a06bf1d067bc82b9bafbce31bc4510782e2a83ee6d](https://etherscan.io/tx/0x0200b66f31756427a0c3d6a06bf1d067bc82b9bafbce31bc4510782e2a83ee6d), implementations: [0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd](https://etherscan.io/address/0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd#code)

## Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-03-04 09:19 UTC](https://l2beat.com/layer2s/projects/shibarium?update=cca08e21) (1 change)

minus one vali.

### [2026-03-02 14:29 UTC](https://l2beat.com/layer2s/projects/shibarium?update=87055ae0) (1 change)

vali added.

### [2025-10-15 13:58 UTC](https://l2beat.com/layer2s/projects/shibarium?update=ea36c6a6) (high severity, 9 changes)

WithdrawalManager upgrade with support for blacklisting.

### [2025-09-25 12:09 UTC](https://l2beat.com/layer2s/projects/shibarium?update=d453f77e) (high severity, 21 changes)

stakeManager upgrade. here is the diff to the non-reverting stakeManager before the hack: https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A

the main addition is the blacklist. the reverts from the interim implementation have been removed.

### [2025-09-15 04:40 UTC](https://l2beat.com/layer2s/projects/shibarium?update=fe57d868) (high severity, 75 changes)

Shibarium hack upgrades and changes

malicious root finalized (10/12 validators signed):
- https://x.com/TikkalaResearch/status/1966610862149665126
- https://app.blocksec.com/explorer/tx/eth/0x50228355eaf263320eed31c1d700acd0294b658a04b3d4313c9f8cb739accda9

StakeManager upgrade after [the shibarium hack](https://x.com/buzzdefi0x/status/1966658844517421132).
- transferFunds, unstakeClaim, withdrawDelegatorsReward, _transferToken, _transferTokenFrom: added reverts
- rescueBone() added: allows a hardcoded address to move ERC-20s out of the contract (permission added)
- [diff](https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207)

Owner/permission changes:
- [unverified manager](https://etherscan.io/address/0xda9CE7617EcFfDeC55c860A651611ef273a3D1dB) removed (was not part of the hack, seems to have been some ccip adapter: https://app.blocksec.com/explorer/tx/eth/0x3a45b367cd3ca13dc77ef8859110a0d84571db8326ac82909d6eac414972acc9)
- one EOA has been replaced by another one (0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96) for most system contracts apart from predicates

Config change:
- WithdrawalManager.HALF_EXIT_PERIOD: 1 -> 864000

still EOA governed of course.

### [2025-09-12 07:15 UTC](https://l2beat.com/layer2s/projects/shibarium?update=860520b6) (3 changes)

Add a new unverified contract as manager for the ERC20 escrow (can steal).

### [2025-07-14 12:46 UTC](https://l2beat.com/layer2s/projects/shibarium?update=d98cf291) (24 changes)

Discovery rerun on the same block number with only config-related changes.

### [2025-04-22 14:34 UTC](https://l2beat.com/layer2s/projects/shibarium?update=8fedbc00) (61 changes)

Contracts have been verified, mainly the ones regarding StakeManager. Everything is practically identical to Polygon PoS, except that to join the validator set you need to be whitelisted.

### [2025-04-14 10:46 UTC](https://l2beat.com/layer2s/projects/shibarium?update=41921d1e) (21 changes)

Polygon PoS fork controlled by EOA and lots of unverified contracts.

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/shibarium

### Ethereum

#### Actors

##### RootChainManager

Addresses: [0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82](https://etherscan.io/address/0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82)

Main configuration contract to manage tokens, token types, escrows (predicates) for given token types. It also serves as an entry point for deposits and withdrawals effectively acting as a token router.
- Can interact with ERC1155Predicate
  - move any tokens to or from the escrow
- Can interact with MintableERC721Predicate
  - move any tokens to or from the escrow
- Can interact with ERC721Predicate
  - move any tokens to or from the escrow
- Can interact with EtherPredicate
  - move any tokens to or from the escrow

##### EOA 1

Addresses: [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96)

- Can upgrade **with no delay**
  - ERC1155Predicate
  - MintableERC721Predicate
  - RootChainManager
  - EventsHub
  - StakeManager
  - ERC20Predicate
  - ERC721Predicate
  - EtherPredicate
- Can interact with ERC1155Predicate
  - assign any access control roles that can access the escrow
- Can interact with MintableERC721Predicate
  - assign any access control roles that can access the escrow
- Can interact with StakeManagerExtension
  - can update the validator registry address used to check whitelist inclusion
- Can interact with ValidatorRegistry
  - can update the whitelist of validators
- Can interact with WithdrawalManager
  - manage critical config values like the exit period and the blacklist
- Can interact with StakeManager
  - can manage the validator blacklist and change other critical settings related to staking [via: Governance]
  - can replace all validators and change the root chain address
- Can interact with ERC20Predicate
  - assign any access control roles that can access the escrow
- Can interact with DepositManager
  - can update the root chain it references
- Can interact with SlashingManager
  - can update how much of the slashed funds go to the proposer and reporter
- Can interact with ERC721Predicate
  - assign any access control roles that can access the escrow
- Can interact with EtherPredicate
  - assign any access control roles that can access the escrow
- Can interact with RootChain
  - can delete arbitrary checkpoints

##### EOA 2

Addresses: [0x80Cc222EA02F4334F67e9E55E7412fed62599004](https://etherscan.io/address/0x80Cc222EA02F4334F67e9E55E7412fed62599004)

- Can interact with ERC1155Predicate
  - move any tokens to or from the escrow
- Can interact with MintableERC721Predicate
  - move any tokens to or from the escrow
- Can interact with ERC20Predicate
  - move any tokens to or from the escrow
- Can interact with ERC721Predicate
  - move any tokens to or from the escrow
- Can interact with EtherPredicate
  - move any tokens to or from the escrow

## Smart contracts

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/shibarium

### Ethereum

#### StakeManagerExtension

Addresses: [0x17174796E0eF24330aed565c87Ba5e85431DE19e](https://etherscan.io/address/0x17174796E0eF24330aed565c87Ba5e85431DE19e#code)

Contract primarily used to check whether a validator is whitelisted or not. It also provides the ability to update the validator registry address.
- Roles:
  - **owner**: EOA 1

#### StateSender

Addresses: [0x3a122785bC4d951D132B2CAD31FC187D6DC7A21C](https://etherscan.io/address/0x3a122785bC4d951D132B2CAD31FC187D6DC7A21C#code)

Smart contract allowing whitelisted addresses to send messages to contracts on the child chain.

#### ValidatorRegistry

Addresses: [0x53D63B9523Ab13399e2071BB4056bbc7Bf98e6A6](https://etherscan.io/address/0x53D63B9523Ab13399e2071BB4056bbc7Bf98e6A6#code)

Defines the whitelist of validators that can stake and therefore participate in the PoS consensus protocol.
- Roles:
  - **owner**: EOA 1

#### WithdrawalManager

Addresses: [0x5F683665ca87dbC3D1358913da80e3C71c328Fb0](https://etherscan.io/address/0x5F683665ca87dbC3D1358913da80e3C71c328Fb0#code), [0xD12B1d5f28736cE0Bfd9330F5595d3fFE6e01A97](https://etherscan.io/address/0xD12B1d5f28736cE0Bfd9330F5595d3fFE6e01A97#code) (Implementation (Upgradable))

Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager. It has blacklisting support.
- Roles:
  - **owner**: EOA 1

#### StakeManager

Addresses: [0x65218A41Fb92637254B4f8c97448d3dF343A3064](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code), [0x269C0ebb7a39995dB531Ccd61D015e431530b87A](https://etherscan.io/address/0x269C0ebb7a39995dB531Ccd61D015e431530b87A#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: 5, Last upgrade: 1y ago, Avg upgrade interval: 3mo 24d)

- 2025-09-24 19:46 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xa214ba95a5640e38fdbae0e1e9fb12b38fea89906efa333f37ae2f65d56bfd7c](https://etherscan.io/tx/0xa214ba95a5640e38fdbae0e1e9fb12b38fea89906efa333f37ae2f65d56bfd7c), implementations: [0x269C0ebb7a39995dB531Ccd61D015e431530b87A](https://etherscan.io/address/0x269C0ebb7a39995dB531Ccd61D015e431530b87A#code) ([diff](https://disco.l2beat.com/diff/eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207/eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A))
- 2025-09-13 06:40 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xb29de7fcedb239478107bc733122b48e0b61a6b9c65dee54284eff1c20f5ebf3](https://etherscan.io/tx/0xb29de7fcedb239478107bc733122b48e0b61a6b9c65dee54284eff1c20f5ebf3), implementations: [0x94e5C17983cf1631e7135C33CF0e6206FF995207](https://etherscan.io/address/0x94e5C17983cf1631e7135C33CF0e6206FF995207#code) ([diff](https://disco.l2beat.com/diff/eth:0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580/eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207))
- 2025-09-13 00:57 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x474dad78a461d4a14303b22644ee0187662be48801886610b267f828cf1e163e](https://etherscan.io/tx/0x474dad78a461d4a14303b22644ee0187662be48801886610b267f828cf1e163e), implementations: [0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580](https://etherscan.io/address/0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580#code) ([diff](https://disco.l2beat.com/diff/eth:0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6/eth:0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580))
- 2025-09-12 23:15 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0xd279065a7d358769b5ad90287789af79eadc3575d56c97f69ffe723e42da2ee6](https://etherscan.io/tx/0xd279065a7d358769b5ad90287789af79eadc3575d56c97f69ffe723e42da2ee6), implementations: [0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6](https://etherscan.io/address/0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6#code) ([diff](https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6))
- 2024-11-30 00:34 UTC, upgrade of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x3278cdbe9d195ccb8cdc22c3c3613affb1b4ce5f01daf4eea713d29b49b6e5a7](https://etherscan.io/tx/0x3278cdbe9d195ccb8cdc22c3c3613affb1b4ce5f01daf4eea713d29b49b6e5a7), implementations: [0x1be79AED4088A55f5ED249a14f777758d9F888c6](https://etherscan.io/address/0x1be79AED4088A55f5ED249a14f777758d9F888c6#code) ([diff](https://disco.l2beat.com/diff/eth:0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6))
- 2024-11-29 21:10 UTC, deployment of [StakeManager](https://etherscan.io/address/0x65218A41Fb92637254B4f8c97448d3dF343A3064#code): transaction [0x80b2df040001f763336e32a7a1784fe5af6b8a9645d79f9f28e2a53e6b76eece](https://etherscan.io/tx/0x80b2df040001f763336e32a7a1784fe5af6b8a9645d79f9f28e2a53e6b76eece), implementations: [0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584](https://etherscan.io/address/0xa5eeE6a1478c9c1b80f6f242D230C309107Cc584#code)

Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. After the shibarium hack, this contract also includes a validator blacklist managed by Governance.
- Roles:
  - **admin**: EOA 1
  - **governance**: Governance; ultimately EOA 1
  - **owner**: EOA 1

Can be upgraded by: EOA 1 with no delay

#### Governance

Addresses: [0xC476E20c2F7FA3B35aC242aBE71B59e902242f06](https://etherscan.io/address/0xC476E20c2F7FA3B35aC242aBE71B59e902242f06#code), [0x3ca9770a30c61e6cF0a4bDD66A26Cee61AE51e65](https://etherscan.io/address/0x3ca9770a30c61e6cF0a4bDD66A26Cee61AE51e65#code) (Implementation (Upgradable))

Simple contract that allows the owner to call an `update` function on arbitrary contracts.
- Roles:
  - **owner**: EOA 1

#### RootChain

Addresses: [0xd46042f503B8Ec0A166af8C0BFbB0a3C562353F9](https://etherscan.io/address/0xd46042f503B8Ec0A166af8C0BFbB0a3C562353F9#code), [0xb3bfb2aE369a0e9D9735ac679e4A14eD81E837fA](https://etherscan.io/address/0xb3bfb2aE369a0e9D9735ac679e4A14eD81E837fA#code) (Implementation (Upgradable))

Contract storing chain checkpoints. Note that validity of these checkpoints is not verified, it is assumed to be valid if signed by 2/3 of the validators.
- Roles:
  - **owner**: EOA 1

#### ERC1155Predicate

Addresses: [0x0057bed57066F61c64DACB395B38c6E1792e03B8](https://etherscan.io/address/0x0057bed57066F61c64DACB395B38c6E1792e03B8#code), [0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610](https://etherscan.io/address/0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2023-08-08 06:25 UTC, deployment of [ERC1155Predicate](https://etherscan.io/address/0x0057bed57066F61c64DACB395B38c6E1792e03B8#code): transaction [0xee350a63a70b71d85dca0d0154a14b13d67f3b48a11857fcf938cddfe26a8a99](https://etherscan.io/tx/0xee350a63a70b71d85dca0d0154a14b13d67f3b48a11857fcf938cddfe26a8a99), implementations: [0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610](https://etherscan.io/address/0xCbb0D2eCBEDBF2D0F0D5616dFE25bC286D8F8610#code)

- Roles:
  - **admin**: EOA 1
  - **defaultAdmin**: EOA 1
  - **managers**: EOA 2, RootChainManager

Can be upgraded by: EOA 1 with no delay

#### MintableERC721Predicate

Addresses: [0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665](https://etherscan.io/address/0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665#code), [0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b](https://etherscan.io/address/0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2023-08-08 06:23 UTC, deployment of [MintableERC721Predicate](https://etherscan.io/address/0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665#code): transaction [0xb4b02d47286a8569107dcbb8d73af8ab2e897abad6a70f1718fd60222e4a2922](https://etherscan.io/tx/0xb4b02d47286a8569107dcbb8d73af8ab2e897abad6a70f1718fd60222e4a2922), implementations: [0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b](https://etherscan.io/address/0x37A9b4e7c327c449858dba9F5e39CE6771cBc31b#code)

- Roles:
  - **admin**: EOA 1
  - **defaultAdmin**: EOA 1
  - **managers**: EOA 2, RootChainManager

Can be upgraded by: EOA 1 with no delay

#### EventsHub

Addresses: [0x12185669Dac70749f717247971E0B8819b2e472e](https://etherscan.io/address/0x12185669Dac70749f717247971E0B8819b2e472e#code), [0x01E988D4b8E86496a45C842E60155a9472541266](https://etherscan.io/address/0x01E988D4b8E86496a45C842E60155a9472541266#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

- Roles:
  - **admin**: EOA 1

Can be upgraded by: EOA 1 with no delay

#### StakingNFT

Addresses: [0x495eea66B0f8b636D441dC6a98d8F5C3D455C4c0](https://etherscan.io/address/0x495eea66B0f8b636D441dC6a98d8F5C3D455C4c0#code)

#### StakingInfo

Addresses: [0x539964b3d225194717fb896D26c8b3E635b8A1aE](https://etherscan.io/address/0x539964b3d225194717fb896D26c8b3E635b8A1aE#code)

Contains logging and getter functions about staking.

#### ERC20Predicate (0x6Aca…A4Fa, escrow)

Addresses: [0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa](https://etherscan.io/address/0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa#code), [0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd](https://etherscan.io/address/0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2023-08-08 06:19 UTC, deployment of [ERC20Predicate](https://etherscan.io/address/0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa#code): transaction [0x0200b66f31756427a0c3d6a06bf1d067bc82b9bafbce31bc4510782e2a83ee6d](https://etherscan.io/tx/0x0200b66f31756427a0c3d6a06bf1d067bc82b9bafbce31bc4510782e2a83ee6d), implementations: [0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd](https://etherscan.io/address/0xfffC2D781999F09A8b127f8Ef419a3EeD2EDa1dd#code)

- Roles:
  - **admin**: EOA 1
  - **defaultAdmin**: EOA 1
  - **managers**: EOA 2

All supported tokens in this escrow are included in the value secured calculation.

Can be upgraded by: EOA 1 with no delay

#### ExitNFT

Addresses: [0x7ad7f98f229c5C1EA5161bEd952c3007DBE1F307](https://etherscan.io/address/0x7ad7f98f229c5C1EA5161bEd952c3007DBE1F307#code)

NFTs used to represent a withdrawal in the withdrawal PriorityQueue (Only used for tokens initially deposited via DepositManager).

#### DepositManager (escrow)

Addresses: [0x885fcE983b6a01633f764325B8c3c5D31032C995](https://etherscan.io/address/0x885fcE983b6a01633f764325B8c3c5D31032C995#code), [0x79a674D373551e6CfD22b2ed65cc1Ac09250F430](https://etherscan.io/address/0x79a674D373551e6CfD22b2ed65cc1Ac09250F430#code) (Implementation (Upgradable))

Contract to deposit and escrow ETH, ERC20 or ERC721 tokens.
- Roles:
  - **owner**: EOA 1

All supported tokens in this escrow are included in the value secured calculation.

#### SlashingManager

Addresses: [0x8ed7d143Ef452316Ab1123d28Ab302dC3b80d3ce](https://etherscan.io/address/0x8ed7d143Ef452316Ab1123d28Ab302dC3b80d3ce#code)

Contract that allows the consensus supermajority to slash validators.
- Roles:
  - **owner**: EOA 1

#### ERC721Predicate (0x98C8…730f)

Addresses: [0x98C831cFB18852f7deB3E3a970e907475b49730f](https://etherscan.io/address/0x98C831cFB18852f7deB3E3a970e907475b49730f#code), [0xe0f4555Fcffb181B1D7566d89200105226F29580](https://etherscan.io/address/0xe0f4555Fcffb181B1D7566d89200105226F29580#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: 1, Last upgrade: 2y ago, Avg upgrade interval: 1y 7mo)

- 2024-10-09 16:29 UTC, upgrade of [ERC721Predicate](https://etherscan.io/address/0x98C831cFB18852f7deB3E3a970e907475b49730f#code): transaction [0x0773a0a64bcceb0d4fba20aa39483ea08f1cd58b39899640e8a2c161253f53c5](https://etherscan.io/tx/0x0773a0a64bcceb0d4fba20aa39483ea08f1cd58b39899640e8a2c161253f53c5), implementations: [0xe0f4555Fcffb181B1D7566d89200105226F29580](https://etherscan.io/address/0xe0f4555Fcffb181B1D7566d89200105226F29580#code) ([diff](https://disco.l2beat.com/diff/eth:0x67281E19c31B19f5450d1F218AA29e036C606fC0/eth:0xe0f4555Fcffb181B1D7566d89200105226F29580))
- 2023-08-08 06:21 UTC, deployment of [ERC721Predicate](https://etherscan.io/address/0x98C831cFB18852f7deB3E3a970e907475b49730f#code): transaction [0x2c4200e203ff16184501a19029fcc02264538e65e74e96d142010ebe5a7fcf58](https://etherscan.io/tx/0x2c4200e203ff16184501a19029fcc02264538e65e74e96d142010ebe5a7fcf58), implementations: [0x67281E19c31B19f5450d1F218AA29e036C606fC0](https://etherscan.io/address/0x67281E19c31B19f5450d1F218AA29e036C606fC0#code)

- Roles:
  - **admin**: EOA 1
  - **defaultAdmin**: EOA 1
  - **managers**: EOA 2, RootChainManager

Can be upgraded by: EOA 1 with no delay

#### ERC721Predicate (0x9df5…D5a3)

Addresses: [0x9df56e63CD340F0f3D811dd2aAAEEa42ec27D5a3](https://etherscan.io/address/0x9df56e63CD340F0f3D811dd2aAAEEa42ec27D5a3#code)

#### RLPReader

Addresses: [0xc107664eeEEA2c84e51D56F1B7a479EbCf9541c4](https://etherscan.io/address/0xc107664eeEEA2c84e51D56F1B7a479EbCf9541c4#code)

#### EtherPredicate (escrow)

Addresses: [0xc3897302aB4B42931cB4857050Fa60f53B775870](https://etherscan.io/address/0xc3897302aB4B42931cB4857050Fa60f53B775870#code), [0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA](https://etherscan.io/address/0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA#code) (Implementation (Upgradable)), [0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96](https://etherscan.io/address/0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2023-08-08 06:26 UTC, deployment of [EtherPredicate](https://etherscan.io/address/0xc3897302aB4B42931cB4857050Fa60f53B775870#code): transaction [0x8a1a09d34137ce9d1fa93b6bbfb9312d8cd7c7141a440cee55bd54a2fda93584](https://etherscan.io/tx/0x8a1a09d34137ce9d1fa93b6bbfb9312d8cd7c7141a440cee55bd54a2fda93584), implementations: [0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA](https://etherscan.io/address/0x3f3bF9Ce73CE5a152561f4BF0306de3E3526f8FA#code)

- Roles:
  - **admin**: EOA 1
  - **defaultAdmin**: EOA 1
  - **managers**: EOA 2, RootChainManager

The following tokens are included in the value secured calculation: ETH

Can be upgraded by: EOA 1 with no delay

#### ERC20Predicate (0xdaF1…462c)

Addresses: [0xdaF14950155DF895E9D0fd2521D05477d26F462c](https://etherscan.io/address/0xdaF14950155DF895E9D0fd2521D05477d26F462c#code)

#### Registry

Addresses: [0xF486e3B6A432Bdd6EDaAe85a565CD7682A7862BB](https://etherscan.io/address/0xF486e3B6A432Bdd6EDaAe85a565CD7682A7862BB#code)

Maintains the addresses of the contracts used in the system, part of the old 'plasma bridge'.

The current deployment carries some associated risks:

- Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).