Search

Search for projects by name or address

Starknet logo
Starknet

Badges

About

Starknet is a ZK rollup that uses STARK proofs to securely scale Ethereum and Ethereum blobs for data availability. Starknet is also actively engaged in bringing Bitcoin users the same scale, UX, and liquidity through a variety of products and programs.



Badges

About

Starknet is a ZK rollup that uses STARK proofs to securely scale Ethereum and Ethereum blobs for data availability. Starknet is also actively engaged in bringing Bitcoin users the same scale, UX, and liquidity through a variety of products and programs.


Total
Canonically BridgedCanonically Bridged ValueCanonical
Natively MintedNatively Minted TokensNative
Externally BridgedExternally Bridged ValueExternal

ETH & derivatives
Stablecoins
BTC & derivatives
Other
Compare with other projects
Data source: Voyager API
Past Day UOPS
Past Day Ops count
Max. UOPS
Past day UOPS/TPS Ratio
Compare with other projects

The section shows the operating costs that L2s pay to Ethereum.



Total cost
Avg cost per L2 UOP
Avg cost per day

Compare with other projects

This section shows how much data the project publishes to its data-availability (DA) layer over time. The project currently posts data toEthereumEthereum.



Data posted
Avg size per day
Avg size per L2 UOP

Compare with other projects

This section shows how "live" the project's operators are by displaying how frequently they submit transactions of the selected type. It also highlights anomalies - significant deviations from their typical schedule.

No ongoing anomalies detected

Avg. state updates interval
Past 30 days anomalies
100% normal uptime

Starknet reverts 18mins of history

2026 Jan 5th

Starknet experienced an outage during which blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. production was halted.

Learn more

Starknet upgrades its proving system to Stwo

2025 Oct 19th

Starknet switches to the next-generation proverAn entity that generates the cryptographic proof to convince the verifier that the statement is true. In a ZK-Rollup, the prover generates the ZK (validity) proof to submit to the verifier contract. Stwo to prove its STF on Ethereum L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development..

Learn more
Sequencer failureState validationData availabilityExit windowProposer failure
Sequencer failure
Log via L1

Users can submit transactions to an L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. map, but can’t force them. When users “complain” that their transaction is stuck on L1 and not picked up by the sequencerA party responsible for ordering and executing transactions on the rollup. The sequencer verifies transactions, compresses the data into a block, and submits the data related to it to enable state reconstruction to Ethereum L1 as a single transaction. The data can be either transaction data or state diffs., the Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. minority can bypass the sequencer by posting a state rootA cryptographic hash succinctly representing a state using a Merkle tree. that includes it.

State validation
Validity proofs (ST)

STARKs are zero knowledge proofs that ensure state correctness.

Data availability
Onchain (SD)

All of the data (SD = state diffs) needed for proof construction is published onchain.

Exit window
None (emergency upgrade path)
7d (regular upgrade path)

Non-emergency upgrades are initiated on L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. and go through a 8d delay. In case users are censored, the Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. minority can be alerted to enforce censorship resistance by submitting a new state rootA cryptographic hash succinctly representing a state using a Merkle tree.. This process is assumed to take 1d, leaving users 7d to exit.

There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

Proposer failure
Security Council minority

Only the whitelisted proposerIn the context of L2s, the actor that proposes a claimed state root on L1. The term is also used in the context of Ethereum to refer to the actor that proposes a new block. can update state rootsA cryptographic hash succinctly representing a state using a Merkle tree. on L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development., so in the event of failure the withdrawals are frozen. The Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. minority can be alerted to enforce censorship resistance because they are a permissioned OperatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades..

Starknet
Starknet is a
Stage 1
ZK Rollup.
The project does not pass the walkaway test: users are not able to exit in the presence of malicious operators if the Security Council disappears.

Learn more about Stages
Please keep in mind that these stages do not reflect project security, this is an opinionated assessment of project maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal.

All data required to reconstruct rollup state is published on chain

State diffs are publish onchain as blobThe data that a rollup publishes to its L1/data availability (DA) layer. They consist of the L2 transactions that are rolled up, along with some metadata. Blobs are introduced as a new transaction type within Ethereum with EIP-4844, and has rollup scaling specifically in mind. Blobs persist on Ethereum’s Beacon Chain ephemerally. or calldata on every state updateA mechanism that allows to update the claimed state of a project. It usually involves verifying a state transition proof, but it can also be done in a trusted manner by a permissioned actor.. The state diffs contain information on every contact whose storage was updated, and additional information on contract deployments. From diffs full system state can be recovered. Contracts’ code is not published on L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development., but can be trustlessly verified if available elsewhere.

  1. On-Chain Data - Starknet documentation
Learn more about the DA layer here: Ethereum logoEthereum
Node software

The Juno nodeA software client that participates in the network. software can be used to reconstruct the L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. state entirely from L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development.. The feature has not been released yet, but can be found in this PR.

Compression scheme
Genesis state

There is no non-empty genesis state.

Data format

The data format has been updated with different versions, and the full specification can be found here.

Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.


Proven Program

The current Starknet OS and aggregator sources are published in the Starknet sequencer repository, and the bootloader sources are published in cairo-lang. The exact 1,166-felt outer bootloader stored onchain has been reproduced from this source revision. However, SHARP also commits to an ordered allowlist of recursive Cairo verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. programs whose active preimages and source-to-hashA fixed-length fingerprint of variable-size input, produced by a hash function. mappings have not been published, so the complete proven program is not independently reproducible.

Validity proofs

Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.

  1. What is Starknet
PROVER

Trusted Setups

Onchain verifier

Used in

Starknet logoParadex logo

Onchain verifier

Used in

Starknet logoParadex logo

Program Hashes

Name
Hash
Repository
Verification
Used in
200638...3432
Starknet logo
105025...1922
Starknet logo
237362...8225
Starknet logo
342795...2024
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

344285...1079
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

235884...3330
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

254986...4351
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

The Starknet OS, virtual Starknet OS, aggregator, outer bootloader, supported-simple-bootloader commitment, and applicative bootloader are reproducible. Every SHARP verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. in the currently accepted fact-registry chain also pins a commitment to an ordered allowlist of recursive Cairo verifier programs. The active allowlist preimages and the programs behind them have not been reproduced, so an invalid nested-proof verifier cannot be ruled out independently.

A diagram of the upgrades and governance
A diagram of the upgrades and governance

The Starknet zk RollupA blockchain that inherits consensus and data availability from another blockchain called L1. Rollups enable trust minimized bridges with the base layer via proof systems, either optimistic or zero-knowledge. A rollup without a bridge, or without considering the bridge, is called a sovereign rollup. shares its SHARP verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. with other StarkEx and SN Stack Layer 2s. Governance of the main Starknet rollup contract and its core bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrows (ETHBridge, STRKBridge) is currently split between two distinct signer groups: the 2/6 Starkware Multisig 1, which forms the normal upgrade path by routing all actions through the DelayedExecutor timelock with a 8d onchain delay, and the 9/12 Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups., which can upgrade instantly and is intended for emergencies only. The delay window on the normal path gives the community time to observe queued actions and allows the Security Council to counteract a malicious action with its instant rights. The 2/4 Starkware Multisig 2 governs most other bridge escrows with instant upgradeabilityThe ability for rollup smart contracts and parameters used in a rollup to be updated by holders of an admin key. Upgradeability represents a vector of risk for users, and should be decentralized and combined with time delays for greater security guarantees.. The shared SHARP verifier used for state validation can be changed by the 2/4 SHARP Multisig with and a 8d delay, affecting all rollups like Starknet that are sharing it.

The OperatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. role in the Starknet contract is permissioned to update the state of the Starknet rollup by supplying valid (zk) state transition proofs. Since this role is not permissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants., Starknet implements a StarknetSCMinorityMultisig with the Operator role, which allows a 3/12 minority of the StarknetSecurityCouncil to enforce censorship resistance by including transactions that are not included by regular Operators.

All bridge escrows allow enabling a withdrawal throttle of 5% of the locked funds per 24h period. Enabling it is permissioned to a Multisig while disabling it in the core bridge escrows (STRKBridge, ETHBridge) can be done by a 3/12 minority of the Security Council.

Governance profile

Security Council

Composition

9/12 onchain Safe multisig — 12 members, geographically and organizationally diverse (<50% from one country, <4 from one organization). The Starknet Foundation appoints and can administratively remove members. No fixed term length and no live tokenholder election mechanism.

Members public

Not mapped, SNIP-25 and Foundation announcements publish only composition criteria (technical reputation, KYC/AML, diversity limits, conflict-of-interest rules).

Charter

SNIP-25 defines duties (security-only mandate), vetting-failure reports, eligibility and the code of conduct.

Can bypass DAO?

Yes — 9/12 can approve and execute an emergency upgrade immediately. The same instant rights let it counteract a malicious action queued in the DelayedExecutor during its 8d window.

DAO can override SC?

No, the community can only dispute the emergency upgrades after the fact in advisory way.

Upgrades

Major upgrade path

Release announcement (≥1 SNIP + specific GitHub commit) → 2-week community deliberation → 1-week final review → 1-week STRK vote on the Governance Hub on L2 → Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. vetting → deployment queued in the DelayedExecutor by the 2/6 Starkware Multisig 1, whose 8d onchain delay covers the procedural ≥7-day freeze → execution. Minimum wall-clock ≈ 5 weeks (8d onchain-enforced if executed via DelayedExecutor).

Minor upgrade path

Announcement (SNIP may be submitted in parallel) → 1-week review → 1-week STRK vote on L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. → deployment queued in the DelayedExecutor, whose 8d onchain delay covers the procedural ≥5-day freeze → execution. No Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. approval required. Minimum wall-clock ≈ 22 days (8d onchain-enforced if executed via DelayedExecutor).

Emergency upgrade path

9/12 Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups., instant.

Exit window

8d enforced onchain by the DelayedExecutor on the normal upgrade path (procedurally ≥7 days after the vote for major releases, ≥5 days for minor). 0 for emergency upgrades by the Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups..

Token governance

Governance token

STRK — ~10.15B total supply, not permanently capped. Users can vote with L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. STRK, natively staked STRK or L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. vSTRK tokens, each gives 1 vote. In 2025 the Starknet Foundation delegated ~1.7B STRK to ~180 ecosystem delegates.

Voting venue

Starknet Governance Hub using Snapshot X — proposals, space configuration and results are recorded and verified on Starknet, with relayed gasless signed votes.

Proposal threshold

None, but proposal admission is curated, not triggered permissionlessly by an onchain token threshold.

Quorum

No protocol-wide quorum rule published. Historical votes used a simple majority with no minimum quorum.

Execution model

Vote as onchain record, permissioned deployment — passed proposals are queued in the DelayedExecutor by the 2/6 Starkware Multisig 1 and execute after 8d.

Past upgrades

The metrics include upgrades on the currently used proxy contracts. Historical proxy contracts and changes of such are not included.

Count of upgrades
80
Last upgrade
2mo 16d ago
Avg upgrade interval
7mo 9d
2026 July 10, 10:17 UTC
High severity
6changes

Updated Starknet OS and aggregation ZK programs, new versions verified.

contract Starknet (eth:0xc662c410C0ECf747543f5bA90660f6ABeBD9C8c4) [starknet/Starknet] {
+++ description: Central rollup contract. Receives (verified) state roots from the Sequencer, allows users to consume L2 -> L1 messages and send L1 -> L2 messages. Critical configuration values for the L2's logic are defined here by various governance roles.
values.aggregatorHashMapped:
- "2571508110958925737463010241874806654058743535666147712534445437599630018294"
+ "1050253032170513549151251823521174837478197699740478552102884446098263561922"
values.aggregatorProgramHash:
- "2571508110958925737463010241874806654058743535666147712534445437599630018294"
+ "1050253032170513549151251823521174837478197699740478552102884446098263561922"
values.configHash:
- "3188242426588271529884520804512942022765170489242162533995649881904346336763"
+ "2579130946496422157802313572919622021390761807038780433165936715591440018810"
+++ description: The L2 programHash which is a hash of the L2 state machine logic. Liveness config MUST be changed in the .ts as soon as this is updated.
+++ severity: HIGH
values.programHash:
- "2733003247060056328192560178934419513655729851806095615814023997114795707702"
+ "2006389624453304912912750132846114593020263069652857561377702883656839453432"
values.programHashHistory.14:
+ "2733003247060056328192560178934419513655729851806095615814023997114795707702"
values.programHashMapped:
- "2733003247060056328192560178934419513655729851806095615814023997114795707702"
+ "2006389624453304912912750132846114593020263069652857561377702883656839453432"
}
2026 July 08, 09:36 UTC
2changes

Rotated two ms members.

contract Starkware SCMinority Multisig (eth:0xF6b0B3e8f57396CecFD788D60499DB49Ee6AbC6B) [GnosisSafe] {
+++ description: None
values.$members.1:
- "eth:0x04D5b12b196a8CADEB2F476F22Ffb1334Ef9F94c"
+ "eth:0x99E84d004E73CC41eFacd382ef6FD34208B0F122"
values.$members.2:
- "eth:0x5C7DcaECB4D8e49Ea2487c5Cc23C5131Ddb2252F"
+ "eth:0xb731B63eC22904A17d1cf6fD771eb5BA87f35Fa3"
}
2026 July 06, 10:59 UTC
4changes

Rotated two ms members.

contract Starkware Security Council (eth:0x15e8c684FD095d4796A0c0CF678554F4c1C7C361) [GnosisSafe] {
+++ description: None
values.$members.3:
- "eth:0x2914767E232FD7708ab06bA60dB16c36C555751d"
+ "eth:0x49C6396070D3310f335AE19169Da6B80ea67B831"
values.$members.4:
- "eth:0xfaECfa5E4180dd55D15396F804Fd00C6dbA233B0"
+ "eth:0x16117672EBF77d5DE9a1Af91F8F79b26421b310F"
}
contract Starkware SCMinority Multisig (eth:0xF6b0B3e8f57396CecFD788D60499DB49Ee6AbC6B) [GnosisSafe] {
+++ description: None
values.$members.0:
- "eth:0x2914767E232FD7708ab06bA60dB16c36C555751d"
+ "eth:0x49C6396070D3310f335AE19169Da6B80ea67B831"
values.$members.4:
- "eth:0xfaECfa5E4180dd55D15396F804Fd00C6dbA233B0"
+ "eth:0x16117672EBF77d5DE9a1Af91F8F79b26421b310F"
}
2026 April 21, 08:57 UTC
High severity
13changes

Starknet v0.14.2 upgrade: https://x.com/StarkWareLtd/status/2046232501887062448. Upgraded Rollup contract with minimal diff: https://disco.l2beat.com/diff/eth:0x2793010E6711Acd5C46ed17f2183a9d58db71e04/eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A (mainly added safety checks on L1 - L2 msg hash computation). Also upgraded aggregation and starknet os programs: sources are here https://github.com/starkware-libs/sequencer/tree/c294a8ba263834d45cf525217d8700f5de24a260/crates/apollo starknet os program/src/cairo/starkware/starknet/core.

contract Starknet (eth:0xc662c410C0ECf747543f5bA90660f6ABeBD9C8c4) {
+++ description: Central rollup contract. Receives (verified) state roots from the Sequencer, allows users to consume L2 -> L1 messages and send L1 -> L2 messages. Critical configuration values for the L2's logic are defined here by various governance roles.
sourceHashes.1:
- "0x8074e96abc7cacf654908c0111c69027cf599f3b67332f3680c5de768a2d6dfe"
+ "0x4ebd3e71fba7928b1daa4cdd93a1081aa0b578578cc8e6aada6a3b86b057fcb5"
values.$implementation:
- "eth:0x2793010E6711Acd5C46ed17f2183a9d58db71e04"
+ "eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A"
values.$pastUpgrades.10:
+ ["2026-04-20T11:53:35.000Z","0xb2fd817ea47d39435e0b08825964bcb0b2ae08ebc4c5a47954f9b169235ed1c1",["eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A"]]
values.$upgradeCount:
- 10
+ 11
values.aggregatorHashMapped:
- "1701025211190912681772481128523426351562426117847395998223683709327746845867"
+ "2571508110958925737463010241874806654058743535666147712534445437599630018294"
values.aggregatorProgramHash:
- "1701025211190912681772481128523426351562426117847395998223683709327746845867"
+ "2571508110958925737463010241874806654058743535666147712534445437599630018294"
values.identify:
- "StarkWare_Starknet_2025_10"
+ "StarkWare_Starknet_2026_11"
values.implementation:
- "eth:0x2793010E6711Acd5C46ed17f2183a9d58db71e04"
+ "eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A"
+++ description: The L2 programHash which is a hash of the L2 state machine logic. Liveness config MUST be changed in the .ts as soon as this is updated.
+++ severity: HIGH
values.programHash:
- "918745833886511857768061986591752808672496300091957204265383861063635175685"
+ "2733003247060056328192560178934419513655729851806095615814023997114795707702"
values.programHashHistory.13:
+ "918745833886511857768061986591752808672496300091957204265383861063635175685"
values.programHashMapped:
- "918745833886511857768061986591752808672496300091957204265383861063635175685"
+ "2733003247060056328192560178934419513655729851806095615814023997114795707702"
implementationNames.eth:0x2793010E6711Acd5C46ed17f2183a9d58db71e04:
- "Starknet"
implementationNames.eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A:
+ "Starknet"
}
2026 January 27, 10:45 UTC
4changes

Added new EOA to be a security agent for ETH and STRK bridge (can enable withdrawal limit).

contract ETHBridge (eth:0xae0Ee0A63A2cE6BaeEFFE56e7714FB4EFE48D419) {
+++ description: Standard Starkware canonical bridge escrow for ETH. Withdrawals can be throttled to 5% of the locked funds per 24 hours.
values.accessControl.SECURITY_AGENT.members.1:
+ "eth:0x4032bE860716F6e4488CBc9f1505E26E2FA3C2c2"
values.secAgentAC.1:
+ "eth:0x4032bE860716F6e4488CBc9f1505E26E2FA3C2c2"
}
contract STRKBridge (eth:0xcE5485Cfb26914C5dcE00B9BAF0580364daFC7a4) {
+++ description: Standard Starkware bridge escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.
values.accessControl.SECURITY_AGENT.members.1:
+ "eth:0x4032bE860716F6e4488CBc9f1505E26E2FA3C2c2"
values.secAgentAC.1:
+ "eth:0x4032bE860716F6e4488CBc9f1505E26E2FA3C2c2"
}

The system has a centralized operator

The operatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. is the only entity that can propose blocksAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over.. A live and trustworthy operator is vital to the health of the system. Typically, the Operator is the hot wallet of the Starknet service submitting state updates for which proofs have been already submitted and verified.

  • MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

Users can't force any transaction

There is no general mechanism to force the sequencerA party responsible for ordering and executing transactions on the rollup. The sequencer verifies transactions, compresses the data into a block, and submits the data related to it to enable state reconstruction to Ethereum L1 as a single transaction. The data can be either transaction data or state diffs. to include the transaction.

  • Users can be censored if the operator refuses to include their transactions.

  1. Censorship resistance of Starknet - Forum Discussion

Transactions are ordered by centralized sequencers

Starknet v0.14.3 uses 5 equal-weight, permissioned consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. sequencers controlled by StarkWare. A proposerIn the context of L2s, the actor that proposes a claimed state root on L1. The term is also used in the context of Ethereum to refer to the actor that proposes a new block. is selected in deterministic round-robin order and builds from its own peer-to-peer synchronized mempool. The current deployment uses an honest-majority Tendermint configuration, requiring 3/5 votes to decide a blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over.. This provides process-level redundancy, but no independence from StarkWare for ordering or preconfirmations.

State advancement on Ethereum is a separate, also permissioned pipeline. Starknet OS execution tasks are proved and recursively aggregated through StarkWare’s SHARP service, using Stwo for proving tasks and Stone for the roots of the recursive tree. After the resulting proof fact is registered on Ethereum, only the 2 Starknet Operators can update the canonical state: the service OperatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. and the Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. minority.

There is no user-callable forced-inclusion function. A censored user can post an L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development.-to-L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. message and ask the Security Council minority to bypass consensus by including it in a valid, proven state updateA mechanism that allows to update the claimed state of a project. It usually involves verifying a state transition proof, but it can also be done in a trusted manner by a permissioned actor., but the contact and response process has no protocol deadline.

Centralized sequencing spec sheet
Trusted preconfirmation
1.5s L2 block time
Trusted ordering
Higher explicit tips first
Sequencer
5-node Tendermint
Real-time censorship resistance
Forced inclusion
Security Council minority
Inclusion delay
No protocol deadline
Inclusion mechanics
Permissioned inclusion
Exit delay
Council response + proving
Exit economics
STARK proof + council action

Censorship resistance

The permissioned sequencerA party responsible for ordering and executing transactions on the rollup. The sequencer verifies transactions, compresses the data into a block, and submits the data related to it to enable state reconstruction to Ethereum L1 as a single transaction. The data can be either transaction data or state diffs. committee provides no real-time censorship resistance. The Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups. minority can conditionally bypass consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. with a valid, proven state updateA mechanism that allows to update the claimed state of a project. It usually involves verifying a state transition proof, but it can also be done in a trusted manner by a permissioned actor., but because users cannot invoke this path and it has no deadline, Starknet provides no deterministic eventual censorship-resistance guarantee.

  1. Starknet documentation - Transaction lifecycle
  2. Starknet documentation - SHARP architecture
  3. Starknet documentation - Current consensus centralization
  4. Starknet v0.14 - Tendermint and preconfirmations
  5. Starknet v0.14.3 - More frequent blocks
  6. Apollo - Mainnet consensus committee configuration
  7. Apollo - Consensus runtime configuration
  8. Apollo - L2 block-time target
  9. Apollo - Deterministic proposer rotation
  10. Apollo - Mempool fee ordering
  11. Starknet documentation - L1-L2 messaging
  12. Starknet - Decentralization roadmap
  13. Starknet core contract - source code

Regular messaging

The user initiates L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups.->L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. messages by submitting a regular transaction on this chain. When the blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. containing that transaction is settled, the message becomes available for processing on L1. ZK proofs are required to settle blocks. Note that the message request can be censored by the SequencerA party responsible for ordering and executing transactions on the rollup. The sequencer verifies transactions, compresses the data into a block, and submits the data related to it to enable state reconstruction to Ethereum L1 as a single transaction. The data can be either transaction data or state diffs..

  • Funds can be frozen if the operator censors withdrawal transaction.

  1. Withdrawing is based on l2 to l1 messages - Starknet documentation

Emergency exit

There is no generic escape hatchThe facility for any user of a rollup to exit the system with their assets under any circumstance. Most relevant in rollups with a centralized proposer, wherein users do not have the ability to propose blocks, but can nonetheless exit the rollup by interacting with a smart contract on L1. mechanism as Starknet cannot be forced by users into a frozen state. Note that a freezing mechanism on L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups., to be secure, requires anti-censorship protection.

A dashboard to explore contracts and permissions
Go to Disco
Disco UI Banner

Ethereum

Actors:

Starkware Multisig 20x0152…C6Ec

A Multisig with 2/4 threshold.

  • Can upgrade with no delay
    • StarkgateManager
    • StarkgateRegistry
    • WBTCBridge
    • FXSBridge
    • sfrxETHBridge
    • FRAXBridge
    • MultiBridge
    • UNIBridge
  • Can upgrade with 3d delay
    • USDTBridge
    • wstETHBridge
    • rETHBridge
    • USDCBridge
  • Can interact with StarkgateManager
    • enroll new tokens, deactivate existing ones (for deposits) or blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. tokens from being added to the Multibridge
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with StarkgateRegistry
    • manage critical access control roles and the role that can upgrade the implementation
  • Can interact with WBTCBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with FXSBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with USDTBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with wstETHBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with rETHBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with sfrxETHBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with FRAXBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with LUSDBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with MultiBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with USDCBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with UNIBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
Starkware Security Council0x15e8…C361

A Multisig with 9/12 threshold.

  • Can upgrade with no delay
    • ETHBridge
    • Starknet
    • STRKBridge
  • Can interact with ETHBridge
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can interact with Starknet
    • Permissioned to manage the OperatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. role, finalize the application configuration, and change the OS program hashA fixed-length fingerprint of variable-size input, produced by a hash function., aggregator program hash, OS-config hash, fee collector, or message cancellation delay
  • Can interact with STRKBridge
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  1. Security Council - Starknet Docs
SHARP Multisig0x21F9…AEc4

A Multisig with 2/4 threshold.

  • Can upgrade with 8d delay
    • SHARPVerifierCallProxy
  • Can interact with SHARPVerifierCallProxy
    • Administer the CallProxy’s GOVERNANCE_ADMIN and role-admin hierarchy. This AccessControl role is separate from the outer proxy governor that schedules implementation upgrades
    • Grant and revoke application roles, including the APP_GOVERNOR role that controls caller-specific fallback routes
    • Route fallback calls from specific callers to a still-active registry in the default verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover.’s reference chain. This principally determines which verifier and bootloader configuration processes their proof submissions; the proxy’s explicit isValid entry point always queries the default target
Used in:
Starkware Multisig 10x83C0…e988

A Multisig with 2/6 threshold.

  • Can upgrade with 8d delay
    • ETHBridge
    • Starknet
    • STRKBridge
  • Can interact with Starknet
    • Permissioned to manage the OperatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. role, finalize the application configuration, and change the OS program hashA fixed-length fingerprint of variable-size input, produced by a hash function., aggregator program hash, OS-config hash, fee collector, or message cancellation delay with 8d delay
Starkware SCMinority Multisig0xF6b0…bC6B

A Multisig with 3/12 threshold.

  • Can interact with ETHBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
  • Can interact with Starknet
    • Permissioned to regularly post L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. state updates and choose an available data-availability entry point. Under the current implementation, every update still needs a fact accepted by SHARP and cannot bypass the pinned program and config hashes
  • Can interact with STRKBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
StarkgateManager0x0c5a…5B60

Acts as a central contract to manage StarkGate bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrows (add new ones, deactivate existing, change configs) when given the Manager role from the respective escrows.

  • Can interact with MultiBridge
    • enroll new tokens or deactivate deposits into the escrow (for each token individually)
Starkware Multisig 40x77Dd…88c5

A Multisig with 1/3 threshold.

Participants (3):

EOA 1EOA 3EOA 2

A Multisig with 3/5 threshold.

Member of Starkware Multisig 4.

  • Can interact with WBTCBridge
    • enable the withdrawal limit
  • Can interact with ETHBridge
    • enable the withdrawal limit
  • Can interact with USDTBridge
    • enable the withdrawal limit
  • Can interact with STRKBridge
    • enable the withdrawal limit
  • Can interact with MultiBridge
    • enable the withdrawal limit
  • Can interact with USDCBridge
    • enable the withdrawal limit

Member of Starkware Multisig 2, Starkware Multisig 4, Starkware Multisig 1, SHARP Multisig.

  • Can interact with WBTCBridge
    • enable the withdrawal limit
  • Can interact with ETHBridge
    • enable the withdrawal limit
  • Can interact with USDTBridge
    • enable the withdrawal limit
  • Can interact with STRKBridge
    • enable the withdrawal limit
  • Can interact with MultiBridge
    • enable the withdrawal limit
  • Can interact with USDCBridge
    • enable the withdrawal limit
  • Can interact with Starknet
    • Permissioned to regularly post L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. state updates and choose an available data-availability entry point. Under the current implementation, every update still needs a fact accepted by SHARP and cannot bypass the pinned program and config hashes
  • Can interact with ETHBridge
    • enable the withdrawal limit
  • Can interact with STRKBridge
    • enable the withdrawal limit
  • Can upgrade with no delay
    • SolvBTCBridge
    • LUSDBridge
  • Can interact with SolvBTCBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
  • Can upgrade with no delay
    • LBTCBridge
  • Can interact with LBTCBridge
    • disable the withdrawal limit and manage the security agent role that can enable it
    • manage critical access control roles related to upgrades and set the proxy governor that can upgrade the implementation
A dashboard to explore contracts and permissions
Go to Disco
Disco UI Banner
A diagram of the smart contract architecture
A diagram of the smart contract architecture

Ethereum

Central Starknet rollupA blockchain that inherits consensus and data availability from another blockchain called L1. Rollups enable trust minimized bridges with the base layer via proof systems, either optimistic or zero-knowledge. A rollup without a bridge, or without considering the bridge, is called a sovereign rollup. contract. For every state updateA mechanism that allows to update the claimed state of a project. It usually involves verifying a state transition proof, but it can also be done in a trusted manner by a permissioned actor. it derives a SHARP fact from the state-transition output and either the Starknet OS or aggregator program hashA fixed-length fingerprint of variable-size input, produced by a hash function., checks that fact through the configured SHARP call proxy, and requires the output’s OS-config hash to match. It also processes L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. <-> L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. messages and stores the finalized L2 state.

  • Roles:
    • admin: DelayedExecutor, Starkware Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups.; ultimately Starkware Multisig 1
    • operators: EOA 4, Starkware SCMinority Multisig
Implementation used in:
CpuVerifierAllSolidity_2026_130x0153…2CD6

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
CpuVerifierDex_2026_130x0cD0…5CdC

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
CairoBootloaderProgram0x2410…4A47

Stores the complete compiled Cairo outer bootloader used as the top-level program of a SHARP proof. The SHARP verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. copies these words into public memory, pinning this exact executable onchain independently of the separately committed simple, applicative, and recursive-verifier programs.

Implementation used in:
CpuVerifierRecursive_2026_130x2867…9B6B

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
CpuVerifierSmall_2026_130x30F3…419b

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
MemoryPageFactRegistry_2023_90x4086…70fA

PermissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. commitment calculator and registry used by the Solidity STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. verifiers. Anyone may submit a public-memory page and interaction elements; the contract computes its hashA fixed-length fingerprint of variable-size input, produced by a hash function. and cumulative product and registers the fact key committing to them, which the CPU verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. must bind to the proof. It is part of the proof verifier, not an application-level program registry. A malicious or nonconforming implementation can break public-memory soundness; binding to a different honest registry generally causes a livenessLiveness refers to the ability of a system to respond to requests and to process them in a timely manner. In the context of L2s, it refers to the ability of settling transactions, proofs and state roots to the base layer. failure instead.

Implementation used in:

Upgradeable call router through which Starknet and other applications access SHARP fact registries. It uses call, not delegatecall, so facts and immutable verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. configuration remain at each target registry. The explicit isValid entry point always queries the default target. Other calls handled by the fallback, principally proof submissions, can be routed per caller to a still-active registry in the default target’s reference chain. The default target can be replaced by SHARP Multisig after 8d.

  • Roles:
    • admin: SHARP Multisig
    • appGovernor: SHARP Multisig
    • appRoleAdmin: SHARP Multisig
    • governanceAdmin: SHARP Multisig
Can be upgraded by:
Proxy used in:
SHARPVerifier0x4956…72b6

Immutable GPS statement verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. shared by Starknet and other StarkWare systems. It verifies a STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.

Implementation used in:
SHARPVerifier_2026_13_10x5C1C…a9fe

Immutable GPS statement verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. shared by Starknet and other StarkWare systems. It verifies a STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.

Implementation used in:
CpuVerifierDexWithBitwise_2026_130x6a67…3F11

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
CpuVerifierStarknet_2026_130x7157…A26D

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
SHARPVerifier_2026_13_20x7Da1…3fF7

Immutable GPS statement verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. shared by Starknet and other StarkWare systems. It verifies a STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.

Implementation used in:
CpuVerifierRecursiveLargeOutput_2026_130xbe0F…AEF3

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
MemoryPageFactRegistry0xe583…C460

PermissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. commitment calculator and registry used by the Solidity STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. verifiers. Anyone may submit a public-memory page and interaction elements; the contract computes its hashA fixed-length fingerprint of variable-size input, produced by a hash function. and cumulative product and registers the fact key committing to them, which the CPU verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. must bind to the proof. It is part of the proof verifier, not an application-level program registry. A malicious or nonconforming implementation can break public-memory soundness; binding to a different honest registry generally causes a livenessLiveness refers to the ability of a system to respond to requests and to process them in a timely manner. In the context of L2s, it refers to the ability of settling transactions, proofs and state roots to the base layer. failure instead.

Implementation used in:
SHARPVerifier_2026_13_30xE675…b406

Immutable GPS statement verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. shared by Starknet and other StarkWare systems. It verifies a STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.

Implementation used in:
CpuVerifierPerpetual_2026_130xFFC7…6b44

Immutable Solidity verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for one Cairo CPU layout. It checks the STARKShort for "scalable transparent argument of knowledge", a STARK is a type of zero-knowledge proof that resolves one of the primary weaknesses of ZK-SNARKs, its reliance on a "trusted setup”. STARKs also come with much simpler cryptographic assumptions, avoiding the need for elliptic curves, pairings, and the knowledge-of-exponent assumption and instead relying purely on hashes and information theory. This means that they are secure even against attackers with quantum computers. proof using layout-specific constraint, OODS, Merkle, FRIA proximity test method that is used to determine whether a set of points is mostly on a polynomial with a degree less than a specified value. It resembles the FFT but the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic., and periodic-column helper contracts. The SHARP verifier can select any configured layout by cairoVerifierId.

Implementation used in:
DelayedExecutor0xCA11…Ca0c

A simple Timelock contract with an immutable delay of 8d. The owner (Starkware Multisig 1) can queue transactions.

  • Roles:
    • owner: Starkware Multisig 1

Standard Starkware canonical bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow for ETH. Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: DelayedExecutor, Starkware Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups.; ultimately Starkware Multisig 1
    • govAdmin: Starkware Security Council
    • secAdmin: Starkware SCMinority Multisig
    • secAgent: EOA 5, Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:
ETH token logo
LORDSBridge
Escrow
0x023A…E5C9

Custom (and immutable) entry point contract and escrow for users depositing LORDS to via StarkGate to the L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups..

The following tokens are included in the value secured calculation:
LORDS token logo

A simple registry that maps tokens to their StarkGate escrows. It also keeps a list of tokens that are blocked from being added to StarkGate.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2

Haltable version of the Starkware Multibridge escrow. Withdrawals can be throttled to 5% of the locked funds per 24 hours for each token individually. Deposits for a particular token can be halted by app governor, halt must be finalized in the second transaction that also sweeps all funds into a clrearing address. There is no logic to resume bridging after the halt.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
    • secAgent: Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:
WBTC token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
FRAX token logo
L1DaiGateway0x9F96…388d

Gateway contract that is the user entrypoint to deposit DAI to a custom escrow to bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. via StarkGate.

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
    • secAgent: Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:
USDT token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
wstETH token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: DelayedExecutor, Starkware Security CouncilA Security Council is a sufficiently decentralized set of members that is able to upgrade a system. A properly set up Security Council consists of at least 8 members with a threshold greater than 75%. What 'sufficiently decentralized' means is fundamentally subjective and L2BEAT evaluates each case individually. A Security Council is allowed to instantly upgrade Stage 1 rollups.; ultimately Starkware Multisig 1
    • govAdmin: Starkware Security Council
    • secAdmin: Starkware SCMinority Multisig
    • secAgent: EOA 5, Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:
STRK token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
rETH token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
sfrxETH token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
FRAX.legacy token logo

Starkware Multibridge escrow. Withdrawals can be throttled to 5% of the locked funds per 24 hours for each token individually.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • manager: StarkgateManager
    • secAdmin: Starkware Multisig 2
    • secAgent: Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:
EKUBO token logoZEND token logoNSTR token logo

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
    • secAgent: Starkware Multisig 4; ultimately EOA 1, EOA 2, EOA 3
The following tokens are included in the value secured calculation:

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: Starkware Multisig 2
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
UNI token logo
DAIBridge
Escrow
0x0437…585C

Simple escrow that accepts tokens and allows to configure permissioned addresses that can access the tokens.

The following tokens are included in the value secured calculation:
DAI token logo

Starkware Multibridge escrow. Withdrawals can be throttled to 5% of the locked funds per 24 hours for each token individually.

  • Roles:
    • admin: EOA 7
    • govAdmin: EOA 7
    • secAdmin: EOA 7
The following tokens are included in the value secured calculation:
LBTC token logo
Can be upgraded by:

Haltable version of the Starkware Multibridge escrow. Withdrawals can be throttled to 5% of the locked funds per 24 hours for each token individually. Deposits for a particular token can be halted by app governor, halt must be finalized in the second transaction that also sweeps all funds into a clrearing address. There is no logic to resume bridging after the halt.

  • Roles:
    • admin: EOA 6
    • govAdmin: EOA 6
    • secAdmin: EOA 6
The following tokens are included in the value secured calculation:
SolvBTC token logo
Can be upgraded by:

Standard Starkware bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge. escrow (single token). Withdrawals can be throttled to 5% of the locked funds per 24 hours.

  • Roles:
    • admin: EOA 6
    • govAdmin: Starkware Multisig 2
    • secAdmin: Starkware Multisig 2
The following tokens are included in the value secured calculation:
LUSD token logo
Can be upgraded by:
CairoBootloaderProgram_2022_70x5d07…9dDf
Implementation used in:
MemoryPageFactRegistry_2022_70xFD14…D1b4
Implementation used in:

The current deployment carries some associated risks:

  • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

Program Hashes

Name
Hash
Repository
Verification
Used in
200638...3432
Starknet logo
105025...1922
Starknet logo
237362...8225
Starknet logo
342795...2024
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

344285...1079
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

235884...3330
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

254986...4351
Starknet logoParadex logoSorare logoedgeX v1 logotanX logo

Projects used in

Search for projects used in

The Starknet OS, virtual Starknet OS, aggregator, outer bootloader, supported-simple-bootloader commitment, and applicative bootloader are reproducible. Every SHARP verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. in the currently accepted fact-registry chain also pins a commitment to an ordered allowlist of recursive Cairo verifier programs. The active allowlist preimages and the programs behind them have not been reproduced, so an invalid nested-proof verifier cannot be ruled out independently.