Search

Search for projects by name

SummaryValue SecuredMilestones & IncidentsRisk summaryRisk analysisState validationPermissionsSmart contracts

Shibarium logoShibarium

Critical contracts can be upgraded by an EOA which could result in the loss of all funds.

Badges

About

Shibarium is an EVM-compatible, proof of stake sidechain for Ethereum. It is built by developers behind the Shiba Inu token ecosystem. The main bridge to Ethereum is currently validated by Shibarium validators and allows for asset as well as data movement...

  • Total Value SecuredTVS
    $2.34 M57.1%
  • Past day UOPSDaily UOPS
    No data
  • Type
    Other
  • Purpose
    Universal
  • Chain ID
    109

    • Tokens breakdown

    Value secured breakdown

    View TVS breakdown
    Sequencer failureState validationData availabilityExit windowProposer failure
    Explore more in Discovery UI

    Badges

    About

    Shibarium is an EVM-compatible, proof of stake sidechain for Ethereum. It is built by developers behind the Shiba Inu token ecosystem. The main bridge to Ethereum is currently validated by Shibarium validators and allows for asset as well as data movement...

    Why is the project listed in others?

    The proof system isn't fully functional

    Consequence: projects without a proper proof system fully rely on single entities to safely update the state. A malicious proposer can finalize an invalid state, which can cause loss of funds.

    There is no data availability bridge

    Consequence: projects without a data availability bridge fully rely on single entities (the sequencer) to honestly rely available data roots on Ethereum. A malicious sequencer can collude with the proposer to finalize an unavailable state, which can cause loss of funds.

    Learn more about the recategorisation here.

    Value SecuredView TVS breakdown

    2024 Sep 16 — 2025 Sep 15

    Total
    $2.34 M57.1%
    Canonically BridgedCanonically Bridged ValueCanonical
    $2.34 M57.1%
    Natively MintedNatively Minted TokensNative
    $0.000.00%
    Externally BridgedExternally Bridged ValueExternal
    $0.000.00%
    ETH & derivatives
    $9.03 K99.0%
    Stablecoins
    $38.9299.9%
    BTC & derivatives
    $0.1299.9%
    Other
    $2.33 M47.5%
    View TVS breakdown
    Milestones & Incidents

    Shibarium bridge exploited

    2025 Sep 12th

    Keys of 10/12 Shibarium validators compromised - malicious chain root state used to steal funds.

    Learn more
    Risk summary

    Funds can be stolen if

    1. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
    2. validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum,
    3. validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

    Users can be censored if

    1. validators on Shibarium decide to not mint tokens after observing an event on Ethereum.
    Risk analysis
    Critical contracts can be upgraded by an EOA which could result in the loss of all funds.
    Sequencer failureState validationData availabilityExit windowProposer failure
    Sequencer failure
    Enqueue via L1

    Users can submit transactions to an L1 queue, but can’t force them. The sequencers cannot selectively skip transactions but can stop processing the queue entirely. In other words, if the sequencers censor or are down, they are so for everyone.

    State validation
    None

    Currently the system permits invalid state roots. More details in project overview.

    Data availability
    External (DAC)

    Proof construction relies fully on data that is NOT published onchain. There exists a Data Availability Committee (DAC) with a threshold of 9/12 that is tasked with protecting and supplying the data.

    Exit window
    None

    There is no window for users to exit in case of an unwanted regular upgrade since contracts are instantly upgradable.

    Proposer failure
    Cannot withdraw

    Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen.

    State validation
    No state validation

    As a fork of Polygon PoS, state updates are settled if signed by at least 2/3+1 of the Shibarium validators stake, without checking whether the state transition is valid. The validator set is gated by a whitelist, which is not public.

    • Users can be censored if validators on Shibarium decide to not mint tokens after observing an event on Ethereum.

    • Funds can be stolen if validators decide to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum.

    • Funds can be stolen if validators submit a fraudulent checkpoint allowing themselves to withdraw all locked funds.

    Permissions
    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    Actors:

    RootChainManager 0x08C4…ad82

    Main configuration contract to manage tokens, token types, escrows (predicates) for given token types. It also serves as an entry point for deposits and withdrawals effectively acting as a token router.

    • Can interact with ERC1155Predicate
      • move any tokens to or from the escrow
    • Can interact with MintableERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with EtherPredicate
      • move any tokens to or from the escrow
    EOA 1 0xBab4…5E96
    • Can upgrade with no delay
      • ERC1155Predicate
      • MintableERC721Predicate
      • RootChainManager
      • EventsHub
      • StakeManager
      • ERC20Predicate
      • ERC721Predicate
      • EtherPredicate
    • Can interact with ERC1155Predicate
      • assign any access control roles that can access the escrow
    • Can interact with MintableERC721Predicate
      • assign any access control roles that can access the escrow
    • Can interact with StakeManagerExtension
      • can update the validator registry address used to check whitelist inclusion
    • Can interact with ValidatorRegistry
    • Can interact with StakeManager
      • can move any ERC20 tokens out of the contract
      • can replace all validators
    • Can interact with ERC20Predicate
      • assign any access control roles that can access the escrow
    • Can interact with DepositManager
      • can update the root chain it references
    • Can interact with SlashingManager
      • can update how much of the slashed funds go to the proposer and reporter
    • Can interact with ERC721Predicate
      • assign any access control roles that can access the escrow
    • Can interact with EtherPredicate
      • assign any access control roles that can access the escrow
    • Can interact with RootChain
      • can delete arbitrary checkpoints
    EOA 2 0x80Cc…9004
    • Can interact with ERC1155Predicate
      • move any tokens to or from the escrow
    • Can interact with MintableERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC20Predicate
      • move any tokens to or from the escrow
    • Can interact with ERC721Predicate
      • move any tokens to or from the escrow
    • Can interact with EtherPredicate
      • move any tokens to or from the escrow
    Smart contracts
    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    StakeManagerExtension 0x1717…E19e

    Contract primarily used to check whether a validator is whitelisted or not. It also provides the ability to update the validator registry address.

    • Roles:
      • owner: EOA 1
    StateSender 0x3a12…A21C

    Smart contract allowing whitelisted addresses to send messages to contracts on the child chain.

    ValidatorRegistry 0x53D6…e6A6

    Defines the whitelist of validators that can stake and therefore participate in the PoS consensus protocol.

    • Roles:
      • owner: EOA 1
    WithdrawalManager 0x5F68…8Fb0Implementation (Upgradable)

    Contract handling users’ withdrawal finalization for tokens escrowed in DepositManager.

    StakeManager 0x6521…3064Implementation (Upgradable)Admin

    Main configuration contract to manage stakers and their voting power and validate checkpoint signatures. This version of the contract has most critical validator management functions blocked (transferFunds, unstakeClaim, withdrawDelegatorsReward, _transferToken, _transferTokenFrom) and ‘rescue’ functions added after the shibarium hack.

    • Roles:
      • admin: EOA 1
      • owner: EOA 1
      • rescuer: EOA 1
    Can be upgraded by:
    EOA 1 with no delay
    Governance 0xC476…2f06Implementation (Upgradable)

    Simple contract that allows the owner to call an update function on arbitrary contracts.

    RootChain 0xd460…53F9Implementation (Upgradable)

    Contract storing chain checkpoints. Note that validity of these checkpoints is not verified, it is assumed to be valid if signed by 2/3 of the validators.

    • Roles:
      • owner: EOA 1
    ERC1155Predicate 0x0057…03B8Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    MintableERC721Predicate 0x03c7…D665Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    EventsHub 0x1218…472eImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
    Can be upgraded by:
    EOA 1 with no delay
    StakingNFT 0x495e…C4c0
    StakingInfo 0x5399…A1aE

    Contains logging and getter functions about staking.

    ERC20Predicate 0x6Aca…A4FaImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2
    • This contract can store any token.
    Can be upgraded by:
    EOA 1 with no delay
    ExitNFT 0x7ad7…F307

    NFTs used to represent a withdrawal in the withdrawal PriorityQueue (Only used for tokens initially deposited via DepositManager).

    DepositManager 0x885f…C995Implementation (Upgradable)

    Contract to deposit and escrow ETH, ERC20 or ERC721 tokens.

    • Roles:
      • owner: EOA 1
    • This contract can store any token.
    SlashingManager 0x8ed7…d3ce

    Contract that allows the consensus supermajority to slash validators.

    • Roles:
      • owner: EOA 1
    ERC721Predicate 0x98C8…730fImplementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    Can be upgraded by:
    EOA 1 with no delay
    ERC721Predicate 0x9df5…D5a3
    RLPReader 0xc107…41c4
    EtherPredicate 0xc389…5870Implementation (Upgradable)Admin
    • Roles:
      • admin: EOA 1
      • defaultAdmin: EOA 1
      • managers: EOA 2, RootChainManager
    • This contract stores the following tokens: ETH.
    Can be upgraded by:
    EOA 1 with no delay
    ERC20Predicate 0xdaF1…462c
    Registry 0xF486…62BB

    Maintains the addresses of the contracts used in the system.

    Value Secured is calculated based on these smart contracts and tokens:

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).