Search

Search for projects by name or address

SummaryValue SecuredMilestones & IncidentsRisk summaryRisk analysisState validationUpgrades & GovernanceUpdatesPermissionsSmart contracts

Shibarium logo
Shibarium

Critical contracts can be upgraded by an EOA which could result in the loss of all funds.

Badges

About

Shibarium is an EVM-compatible, proof of stake sidechain for Ethereum. It is built by developers behind the Shiba Inu token ecosystem. The main bridge to Ethereum is currently validated by Shibarium validators and allows for asset as well as data movement...

  • Total Value SecuredTVS
    $663.42 K2.99%
  • Past day UOPSDaily UOPS
    No data
  • Type
    Other
  • Purpose
    Universal
  • Chain ID
    109

    • Tokens breakdown

    Sequencer failureState validationData availabilityExit windowProposer failure
    Explore more in Discovery UI

    Badges

    About

    Shibarium is an EVM-compatible, proof of stake sidechain for Ethereum. It is built by developers behind the Shiba Inu token ecosystem. The main bridge to Ethereum is currently validated by Shibarium validators and allows for asset as well as data movement...

    Why is the project listed in others?

    The proof system isn't fully functional

    Consequence: projects without a proper proof system fully rely on single entities to safely update the state. A malicious proposer can finalize an invalid state, which can cause loss of funds.

    There is no data availability bridge

    Consequence: projects without a data availability bridge fully rely on single entities (the sequencer) to honestly rely available data roots on Ethereum. A malicious sequencer can collude with the proposer to finalize an unavailable state, which can cause loss of funds.

    Learn more about the recategorisation here.

    Value Secured

    CompareView TVS breakdown
    Total
    Canonically BridgedCanonically Bridged ValueCanonical
    Natively MintedNatively Minted TokensNative
    Externally BridgedExternally Bridged ValueExternal
    ETH & derivatives
    Stablecoins
    BTC & derivatives
    Other
    View TVS breakdown
    Compare with other projects

    Milestones & Incidents

    Shibarium bridge exploited

    2025 Sep 12th

    Keys of 10/12 Shibarium validatorsIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier compromised - malicious chain root state used to steal funds.

    Learn more

    Risk summary

    Funds can be stolen if

    1. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
    2. validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum,
    3. validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

    Users can be censored if

    1. validators on Shibarium decide to not mint tokens after observing an event on Ethereum.

    Risk analysis

    Critical contracts can be upgraded by an EOA which could result in the loss of all funds.
    Sequencer failureState validationData availabilityExit windowProposer failure
    Sequencer failure
    Enqueue via L1

    Users can submit transactions to an L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. queue, but can’t force them. The sequencers cannot selectively skip transactions but can stop processing the queue entirely. In other words, if the sequencers censor or are down, they are so for everyone.

    State validation
    None

    Currently the system permits invalid state rootsA cryptographic hash succinctly representing a state using a Merkle tree.. More details in project overview.

    Data availability
    External (DAC)

    Proof construction relies fully on data that is NOT published onchain. There exists a Data Availability Committee (DAC)A set of members whose task is attesting and ensuring that the data is available for the public. An onchain DAC verifier checks that a threshold of signatures from the DAC members is reached before considering a data commitment as available and therefore valid to be used in the system. with a threshold of 8/11 that is tasked with protecting and supplying the data.

    Exit window
    None

    There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

    Proposer failure
    Cannot withdraw

    Only the whitelisted proposers can publish state rootsA cryptographic hash succinctly representing a state using a Merkle tree. on L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development., so in the event of failure the withdrawals are frozen.

    State validation

    No state validation

    As a fork of Polygon PoS, state updates are settled if signed by at least 2/3+1 of the Shibarium validatorsIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier stake, without checking whether the state transition is valid. The validator set is gated by a whitelist, which is not public.

    • Users can be censored if validators on Shibarium decide to not mint tokens after observing an event on Ethereum.

    • Funds can be stolen if validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum.

    • Funds can be stolen if validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

    Upgrades & Governance

    Past upgrades

    The metrics include upgrades on the currently used proxy contracts. Historical proxy contracts and changes of such are not included.

    Count of upgrades
    6
    Last upgrade
    1y ago
    Avg upgrade interval
    7mo 16d

    Updates

    2026 March 04, 09:19 UTC
    1change

    minus one vali.

    minus one vali.

    contract StakingNFT (eth:0x495eea66B0f8b636D441dC6a98d8F5C3D455C4c0) {
    +++ description: None
    values.totalSupply:
    - 12
    + 11
    }
    2026 March 02, 14:29 UTC
    1change

    vali added.

    vali added.

    contract StakeManager (eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064) {
    +++ description: Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. After the shibarium hack, this contract also includes a validator blacklist managed by eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06.
    values.currentValidatorSetSize:
    - 12
    + 11
    }
    2025 October 15, 13:58 UTC
    High severity
    9changes

    WithdrawalManager upgrade with support for blacklisting.

    WithdrawalManager upgrade with support for blacklisting.

    contract WithdrawalManager (eth:0x5F683665ca87dbC3D1358913da80e3C71c328Fb0) {
    +++ description: Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager. It has blacklisting support.
    template:
    - "polygonposbridge/WithdrawManager"
    + "shibarium/WithdrawManager"
    sourceHashes.1:
    - "0xda0990aeeb22bcf3c867d4f398d00bd7d2f15aef3add8c60800711185b34a09c"
    + "0xcdde166e8888dfe4fae172f6008fe3fbc0bcb1db2e5be1ca6519f3eff028ba7b"
    description:
    - "Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager."
    + "Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager. It has blacklisting support."
    values.$implementation:
    - "eth:0xA5E0bD9dc1F1d55e53ca87496731aE6B768094D3"
    + "eth:0xD12B1d5f28736cE0Bfd9330F5595d3fFE6e01A97"
    values.HALF_EXIT_PERIOD:
    - 864000
    + 302400
    values.implementation:
    - "eth:0xA5E0bD9dc1F1d55e53ca87496731aE6B768094D3"
    + "eth:0xD12B1d5f28736cE0Bfd9330F5595d3fFE6e01A97"
    implementationNames.eth:0xA5E0bD9dc1F1d55e53ca87496731aE6B768094D3:
    - "WithdrawManager"
    implementationNames.eth:0xD12B1d5f28736cE0Bfd9330F5595d3fFE6e01A97:
    + "WithdrawManager"
    }
    EOA (eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96) {
    +++ description: None
    receivedPermissions.4:
    + {"permission":"interact","from":"eth:0x5F683665ca87dbC3D1358913da80e3C71c328Fb0","description":"manage critical config values like the exit period and the blacklist.","role":".owner"}
    }
    2025 September 25, 12:09 UTC
    High severity
    21changes

    stakeManager upgrade. here is the diff to the non-reverting stakeManager before the hack: https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A the main addition is the blacklist. the reverts from the interim implementation have been removed.

    stakeManager upgrade. here is the diff to the non-reverting stakeManager before the hack: https://disco.l2beat.com/diff/eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6/eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A

    the main addition is the blacklist. the reverts from the interim implementation have been removed.

    contract StakeManager (eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064) {
    +++ description: Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. After the shibarium hack, this contract also includes a validator blacklist managed by eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06.
    template:
    - "polygonposbridge/StakeManager_shibarium_revert"
    + "polygonposbridge/StakeManager_shibarium"
    sourceHashes.1:
    - "0x9394ab61559718a01471ac508777c2be71a11c31bd14a7c7b5dc14ee61efbd3b"
    + "0xe2522e34d47444e7e217e066534ccc56536e24f4f582f8585897230965360291"
    description:
    - "Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. This version of the contract has most critical validator management functions blocked (`transferFunds`, `unstakeClaim`, `withdrawDelegatorsReward`, `_transferToken`, `_transferTokenFrom`) and 'rescue' functions added after the shibarium hack."
    + "Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. After the shibarium hack, this contract also includes a validator blacklist managed by eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06."
    values.$implementation:
    - "eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207"
    + "eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A"
    values.$pastUpgrades.5:
    + ["2025-09-24T19:46:35.000Z","0xa214ba95a5640e38fdbae0e1e9fb12b38fea89906efa333f37ae2f65d56bfd7c",["eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A"]]
    values.$upgradeCount:
    - 5
    + 6
    values.auctionPeriod:
    - 0
    + 7
    values.dynasty:
    - 1
    + 30
    values.implementation:
    - "eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207"
    + "eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A"
    values.replacementCoolDown:
    - 13608
    + 29342
    values.rescuer:
    - "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.WITHDRAWAL_DELAY:
    - 1
    + 30
    values.withdrawalDelay:
    - 1
    + 30
    implementationNames.eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207:
    - "StakeManager"
    implementationNames.eth:0x269C0ebb7a39995dB531Ccd61D015e431530b87A:
    + "StakeManager"
    }
    EOA (eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96) {
    +++ description: None
    receivedPermissions.4.via:
    + [{"address":"eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06"}]
    receivedPermissions.4.role:
    - ".rescuer"
    + ".governance"
    receivedPermissions.4.description:
    - "can move any ERC20 tokens out of the contract."
    + "can manage the validator blacklist and change other critical settings related to staking."
    receivedPermissions.5.description:
    - "can replace all validators."
    + "can replace all validators and change the root chain address."
    }
    contract Governance (eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06) {
    +++ description: Simple contract that allows the owner to call an `update` function on arbitrary contracts.
    directlyReceivedPermissions:
    + [{"permission":"interact","from":"eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064","description":"can manage the validator blacklist and change other critical settings related to staking.","role":".governance"}]
    }
    contract Registry (eth:0xF486e3B6A432Bdd6EDaAe85a565CD7682A7862BB) {
    +++ description: Maintains the addresses of the contracts used in the system.
    values.getValidatorShareAddress:
    - "eth:0xe99f1001c8afD34AcF0CEd6aD33137DeE8D81dE6"
    + "eth:0xaB8FB5E1A9777f2A98E86004980A4fCdcd655a04"
    }
    2025 September 15, 04:40 UTC
    High severity
    75changes

    Shibarium hack upgrades and changes malicious root finalized (10/12 validators signed): - https://x.com/TikkalaResearch/status/1966610862149665126 - https://app.blocksec.com/explorer/tx/eth/0x50228355eaf263320eed31c1d700acd0294b658a04b3d4313c9f8cb739accda9 StakeManager upgrade after the shibarium hack. - transferFunds, unstakeClaim, withdrawDelegatorsReward, transferToken, transferTokenFrom: added reverts - rescueBone() added: allows a hardcoded address to move ERC-20s out of the contract (permission added) - diff Owner/permission changes: - unverified manager removed (was not part of the hack, seems to have been some ccip adapter: https://app.blocksec.com/explorer/tx/eth/0x3a45b367cd3ca13dc77ef8859110a0d84571db8326ac82909d6eac414972acc9) - one EOA has been replaced by another one (0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96) for most system contracts apart from predicates Config change: - WithdrawalManager.HALF EXIT PERIOD: 1 - 864000 still EOA governed of course.

    Shibarium hack upgrades and changes

    malicious root finalized (10/12 validators signed):

    • https://x.com/TikkalaResearch/status/1966610862149665126
    • https://app.blocksec.com/explorer/tx/eth/0x50228355eaf263320eed31c1d700acd0294b658a04b3d4313c9f8cb739accda9

    StakeManager upgrade after the shibarium hack.

    • transferFunds, unstakeClaim, withdrawDelegatorsReward, _transferToken, _transferTokenFrom: added reverts
    • rescueBone() added: allows a hardcoded address to move ERC-20s out of the contract (permission added)
    • diff

    Owner/permission changes:

    • unverified manager removed (was not part of the hack, seems to have been some ccip adapter: https://app.blocksec.com/explorer/tx/eth/0x3a45b367cd3ca13dc77ef8859110a0d84571db8326ac82909d6eac414972acc9)
    • one EOA has been replaced by another one (0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96) for most system contracts apart from predicates

    Config change:

    • WithdrawalManager.HALF_EXIT_PERIOD: 1 -> 864000

    still EOA governed of course.

    contract ERC1155Predicate (eth:0x0057bed57066F61c64DACB395B38c6E1792e03B8) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.DEFAULT_ADMIN_ROLE.members.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.defaultAdminAC.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract MintableERC721Predicate (eth:0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.DEFAULT_ADMIN_ROLE.members.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.defaultAdminAC.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract RootChainManager (eth:0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82) {
    +++ description: Main configuration contract to manage tokens, token types, escrows (predicates) for given token types. It also serves as an entry point for deposits and withdrawals effectively acting as a token router.
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    receivedPermissions.2:
    - {"permission":"interact","from":"eth:0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa","description":"move any tokens to or from the escrow.","role":".managersAC"}
    }
    contract EventsHub (eth:0x12185669Dac70749f717247971E0B8819b2e472e) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract StakeManagerExtension (eth:0x17174796E0eF24330aed565c87Ba5e85431DE19e) {
    +++ description: Contract primarily used to check whether a validator is whitelisted or not. It also provides the ability to update the validator registry address.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract StateSender (eth:0x3a122785bC4d951D132B2CAD31FC187D6DC7A21C) {
    +++ description: Smart contract allowing whitelisted addresses to send messages to contracts on the child chain.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract StakingInfo (eth:0x539964b3d225194717fb896D26c8b3E635b8A1aE) {
    +++ description: Contains logging and getter functions about staking.
    values.getAccountStateRoot:
    - "0x76afb575e9c27e66d74045cd8a4c879dc244fb7b9657783249f62e57da12042d"
    + "0x3dc29b6164c27e66d74045cd8a4c879dc244fb7b9657783249f62e57da12042d"
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract ValidatorRegistry (eth:0x53D63B9523Ab13399e2071BB4056bbc7Bf98e6A6) {
    +++ description: Defines the whitelist of validators that can stake and therefore participate in the PoS consensus protocol.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract WithdrawalManager (eth:0x5F683665ca87dbC3D1358913da80e3C71c328Fb0) {
    +++ description: Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager.
    values.HALF_EXIT_PERIOD:
    - 1
    + 864000
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract StakeManager (eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064) {
    +++ description: Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. This version of the contract has most critical validator management functions blocked (`transferFunds`, `unstakeClaim`, `withdrawDelegatorsReward`, `_transferToken`, `_transferTokenFrom`) and 'rescue' functions added after the shibarium hack.
    template:
    - "polygonposbridge/StakeManager_shibarium"
    + "polygonposbridge/StakeManager_shibarium_revert"
    sourceHashes.1:
    - "0x315e4278520bf097047cc2be4371ac60125bba1043fa4e97e7054988fe3ba503"
    + "0x9394ab61559718a01471ac508777c2be71a11c31bd14a7c7b5dc14ee61efbd3b"
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.$implementation:
    - "eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6"
    + "eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207"
    values.$pastUpgrades.2:
    + ["2025-09-12T23:15:11.000Z","0xd279065a7d358769b5ad90287789af79eadc3575d56c97f69ffe723e42da2ee6",["eth:0xA56607Ef5C9713cA667730E9Dbb61156B64d26D6"]]
    values.$pastUpgrades.3:
    + ["2025-09-13T00:57:35.000Z","0x474dad78a461d4a14303b22644ee0187662be48801886610b267f828cf1e163e",["eth:0xb9aFe620ba061d37b1C1A785B48e6b691fFdd580"]]
    values.$pastUpgrades.4:
    + ["2025-09-13T06:40:11.000Z","0xb29de7fcedb239478107bc733122b48e0b61a6b9c65dee54284eff1c20f5ebf3",["eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207"]]
    values.$upgradeCount:
    - 2
    + 5
    values.implementation:
    - "eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6"
    + "eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207"
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.rescuer:
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    implementationNames.eth:0x1be79AED4088A55f5ED249a14f777758d9F888c6:
    - "StakeManager"
    implementationNames.eth:0x94e5C17983cf1631e7135C33CF0e6206FF995207:
    + "StakeManager"
    description:
    + "Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. This version of the contract has most critical validator management functions blocked (`transferFunds`, `unstakeClaim`, `withdrawDelegatorsReward`, `_transferToken`, `_transferTokenFrom`) and 'rescue' functions added after the shibarium hack."
    }
    contract ERC20Predicate (eth:0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.DEFAULT_ADMIN_ROLE.members.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.MANAGER_ROLE.members.1:
    - "eth:0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82"
    values.accessControl.MANAGER_ROLE.members.2:
    - "eth:0xda9CE7617EcFfDeC55c860A651611ef273a3D1dB"
    values.defaultAdminAC.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.managersAC.1:
    - "eth:0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82"
    values.managersAC.2:
    - "eth:0xda9CE7617EcFfDeC55c860A651611ef273a3D1dB"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    EOA (eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004) {
    +++ description: None
    receivedPermissions.0:
    - {"permission":"interact","from":"eth:0x0057bed57066F61c64DACB395B38c6E1792e03B8","description":"assign any access control roles that can access the escrow.","role":".defaultAdminAC"}
    receivedPermissions.2:
    - {"permission":"interact","from":"eth:0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665","description":"assign any access control roles that can access the escrow.","role":".defaultAdminAC"}
    receivedPermissions.4:
    - {"permission":"interact","from":"eth:0x17174796E0eF24330aed565c87Ba5e85431DE19e","description":"can update the validator registry address used to check whitelist inclusion.","role":".owner"}
    receivedPermissions.5:
    - {"permission":"interact","from":"eth:0x53D63B9523Ab13399e2071BB4056bbc7Bf98e6A6","description":"can update the whitelist of validators","role":".owner"}
    receivedPermissions.6:
    - {"permission":"interact","from":"eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064","description":"can replace all validators.","role":".owner"}
    receivedPermissions.7:
    - {"permission":"interact","from":"eth:0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa","description":"assign any access control roles that can access the escrow.","role":".defaultAdminAC"}
    receivedPermissions.9:
    - {"permission":"interact","from":"eth:0x885fcE983b6a01633f764325B8c3c5D31032C995","description":"can update the root chain it references.","role":".owner"}
    receivedPermissions.10:
    - {"permission":"interact","from":"eth:0x8ed7d143Ef452316Ab1123d28Ab302dC3b80d3ce","description":"can update how much of the slashed funds go to the proposer and reporter.","role":".owner"}
    receivedPermissions.11:
    - {"permission":"interact","from":"eth:0x98C831cFB18852f7deB3E3a970e907475b49730f","description":"assign any access control roles that can access the escrow.","role":".defaultAdminAC"}
    receivedPermissions.13:
    - {"permission":"interact","from":"eth:0xc3897302aB4B42931cB4857050Fa60f53B775870","description":"assign any access control roles that can access the escrow.","role":".defaultAdminAC"}
    receivedPermissions.15:
    - {"permission":"interact","from":"eth:0xd46042f503B8Ec0A166af8C0BFbB0a3C562353F9","description":"can delete arbitrary checkpoints.","role":".owner"}
    receivedPermissions.16:
    - {"permission":"upgrade","from":"eth:0x0057bed57066F61c64DACB395B38c6E1792e03B8","role":"admin"}
    receivedPermissions.17:
    - {"permission":"upgrade","from":"eth:0x03c77e03dB8183C8a9eFC178eC1Dfd98c1EfD665","role":"admin"}
    receivedPermissions.18:
    - {"permission":"upgrade","from":"eth:0x08C4b60fda8aA6239b7de7d165BCF6F1686Cad82","role":"admin"}
    receivedPermissions.19:
    - {"permission":"upgrade","from":"eth:0x12185669Dac70749f717247971E0B8819b2e472e","role":"admin"}
    receivedPermissions.20:
    - {"permission":"upgrade","from":"eth:0x65218A41Fb92637254B4f8c97448d3dF343A3064","role":"admin"}
    receivedPermissions.21:
    - {"permission":"upgrade","from":"eth:0x6Aca26bFCE7675FF71C734BF26C8c0aC4039A4Fa","role":"admin"}
    receivedPermissions.22:
    - {"permission":"upgrade","from":"eth:0x98C831cFB18852f7deB3E3a970e907475b49730f","role":"admin"}
    receivedPermissions.23:
    - {"permission":"upgrade","from":"eth:0xc3897302aB4B42931cB4857050Fa60f53B775870","role":"admin"}
    controlsMajorityOfUpgradePermissions:
    - true
    }
    contract DepositManager (eth:0x885fcE983b6a01633f764325B8c3c5D31032C995) {
    +++ description: Contract to deposit and escrow ETH, ERC20 or ERC721 tokens.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract SlashingManager (eth:0x8ed7d143Ef452316Ab1123d28Ab302dC3b80d3ce) {
    +++ description: Contract that allows the consensus supermajority to slash validators.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract ERC721Predicate (eth:0x98C831cFB18852f7deB3E3a970e907475b49730f) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.DEFAULT_ADMIN_ROLE.members.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.defaultAdminAC.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract EtherPredicate (eth:0xc3897302aB4B42931cB4857050Fa60f53B775870) {
    +++ description: None
    values.$admin:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.accessControl.DEFAULT_ADMIN_ROLE.members.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.defaultAdminAC.0:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    values.proxyOwner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract Governance (eth:0xC476E20c2F7FA3B35aC242aBE71B59e902242f06) {
    +++ description: Simple contract that allows the owner to call an `update` function on arbitrary contracts.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    contract RootChain (eth:0xd46042f503B8Ec0A166af8C0BFbB0a3C562353F9) {
    +++ description: Contract storing chain checkpoints. Note that validity of these checkpoints is not verified, it is assumed to be valid if signed by 2/3 of the validators.
    values.owner:
    - "eth:0x80Cc222EA02F4334F67e9E55E7412fed62599004"
    + "eth:0xBab4F3e701F6d2e009Af3C7f1eF2e7dD68225E96"
    }
    - Status: DELETED
    contract managerContract (eth:0xda9CE7617EcFfDeC55c860A651611ef273a3D1dB)
    +++ description: None

    Permissions

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    Actors:

    RootChainManager0x08C4…ad82

    Main configuration contract to manage tokens, token types, escrows (predicates) for given token types. It also serves as an entry point for deposits and withdrawals effectively acting as a token router.

    • Can interact with ERC1155Predicate
      • move any tokens to or from the escrow
    • Can interact with MintableERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with EtherPredicate
      • move any tokens to or from the escrow
    EOA 10xBab4…5E96
    • Can upgrade with no delay
      • ERC1155Predicate
      • MintableERC721Predicate
      • RootChainManager
      • EventsHub
      • StakeManager
      • ERC20Predicate
      • ERC721Predicate
      • EtherPredicate
    • Can interact with ERC1155Predicate
      • assign any access control roles that can access the escrow
    • Can interact with MintableERC721Predicate
      • assign any access control roles that can access the escrow
    • Can interact with StakeManagerExtension
      • can update the validatorIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier registry address used to check whitelist inclusion
    • Can interact with ValidatorRegistry
    • Can interact with WithdrawalManager
      • manage critical config values like the exit period and the blacklist
    • Can interact with StakeManager
      • can manage the validator blacklist and change other critical settings related to staking
      • can replace all validators and change the root chain address
    • Can interact with ERC20Predicate
      • assign any access control roles that can access the escrow
    • Can interact with DepositManager
      • can update the root chain it references
    • Can interact with SlashingManager
      • can update how much of the slashed funds go to the proposerIn the context of L2s, the actor that proposes a claimed state root on L1. The term is also used in the context of Ethereum to refer to the actor that proposes a new block. and reporter
    • Can interact with ERC721Predicate
      • assign any access control roles that can access the escrow
    • Can interact with EtherPredicate
      • assign any access control roles that can access the escrow
    • Can interact with RootChain
      • can delete arbitrary checkpoints
    EOA 20x80Cc…9004
    • Can interact with ERC1155Predicate
      • move any tokens to or from the escrow
    • Can interact with MintableERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC20Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with EtherPredicate
      • move any tokens to or from the escrow

    Smart contracts

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    StakeManagerExtension0x1717…E19e

    Contract primarily used to check whether a validatorIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier is whitelisted or not. It also provides the ability to update the validator registry address.

    • Roles:
      • owner: EOA 1
    StateSender0x3a12…A21C

    Smart contract allowing whitelisted addresses to send messages to contracts on the child chain.

    ValidatorRegistry0x53D6…e6A6

    Defines the whitelist of validatorsIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier that can stake and therefore participate in the PoS consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. protocol.

    • Roles:
      • owner: EOA 1
    WithdrawalManager0x5F68…8Fb0Implementation (Upgradable)

    Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager. It has blacklisting support.

    • Roles:
      • owner: EOA 1
    StakeManager0x6521…3064Implementation (Upgradable)Admin

    Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. After the shibarium hack, this contract also includes a validatorIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier blacklist managed by Governance.

    • Roles:
      • admin: EOA 1
      • governance: Governance; ultimately EOA 1
      • owner: EOA 1
    Can be upgraded by:
    EOA 1 with no delay
    Governance0xC476…2f06Implementation (Upgradable)

    Simple contract that allows the owner to call an update function on arbitrary contracts.

    • Roles:
      • owner: EOA 1
    RootChain0xd460…53F9Implementation (Upgradable)

    Contract storing chain checkpoints. Note that validity of these checkpoints is not verified, it is assumed to be valid if signed by 2/3 of the validatorsIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier.

    • Roles:
      • owner: EOA 1
    ERC1155Predicate0x0057…03B8Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    MintableERC721Predicate0x03c7…D665Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    EventsHub0x1218…472eImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
    Can be upgraded by:
    EOA 1 with no delay
    StakingNFT0x495e…C4c0
    StakingInfo0x5399…A1aE

    Contains logging and getter functions about staking.

    ERC20Predicate
    Escrow
    0x6Aca…A4FaImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2

    All supported tokens in this escrow are included in the value secured calculation.

    Can be upgraded by:
    EOA 1 with no delay
    ExitNFT0x7ad7…F307

    NFTs used to represent a withdrawal in the withdrawal PriorityQueue (Only used for tokens initially deposited via DepositManager).

    DepositManager
    Escrow
    0x885f…C995Implementation (Upgradable)

    Contract to deposit and escrow ETH, ERC20 or ERC721 tokens.

    • Roles:
      • owner: EOA 1

    All supported tokens in this escrow are included in the value secured calculation.

    SlashingManager0x8ed7…d3ce

    Contract that allows the consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. supermajority to slash validatorsIn the context of L2s, a Validator is an actor that validates the correctness of state transitions. For optimistic rollups this corresponds to challengers, and for ZK rollups this corresponds to the onchain verifier.

    • Roles:
      • owner: EOA 1
    ERC721Predicate0x98C8…730fImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    ERC721Predicate0x9df5…D5a3
    RLPReader0xc107…41c4
    EtherPredicate
    Escrow
    0xc389…5870Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    The following tokens are included in the value secured calculation:
    ETH token logo
    Can be upgraded by:
    EOA 1 with no delay
    ERC20Predicate0xdaF1…462c
    Registry0xF486…62BB

    Maintains the addresses of the contracts used in the system, part of the old ‘plasmaPlasma is an offchain scaling solution that is able to support offchain data availability by allowing users to exit even when the data is unavailable. Usually, though, Plasma projects require users to frequently monitor the chain (e.g. at least once per week) to ensure that they can exit in time if necessary. There are attempts to support general smart contracts, but the exit mechanism is often limited to simpler applications. bridgeA message-passing protocol between two blockchains. At its most basic, a token bridge consists of a smart contract which can escrow funds on one side of the bridge, and instruct the release or minting of corresponding assets on the other side, but bridges could also support arbitrary messages. How these instructions are validated is a critical factor in assessing the trust assumptions of a bridge.’.

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).