Bridge rate-limiter / chain-pause as positive mitigant
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor is a positive-mitigant assessment — it contributes to a green grade when present rather than to a red grade when absent. It evaluates two structural controls on a bridge or cross-chain protocol: (1) whether a per-window outflow rate-limiter is implemented in the bridge contract (and at what cap relative to bridge TVL), and (2) whether the protocol team can trigger a chain-level or validator-set emergency pause to freeze further outflow during an active incident.
Why it matters
Bridge exploits have an inherent maximum-loss profile bounded by available liquidity at the moment of attack. Without a rate-limiter, a successful exploit can drain the entire bridge TVL in a single block; with a meaningful rate-limiter, the attacker is forced to surface the exploit incrementally over multiple windows, giving the team and broader ecosystem time to detect, intervene, and pause. Chain-pause capability extends this further — even after an attacker has begun draining, a coordinated validator-set or sequencer halt can freeze remaining funds in place. F185 captures the difference between a structural control that meaningfully bounds blast radius and a hot-bridge architecture where one signature failure is total loss.
Green / Yellow / Red
Green: rate-limiter present with cap ≤10% of bridge TVL per window AND chain-pause capability available to the protocol team. Yellow: one of the two controls present (rate-limiter without chain-pause, or chain-pause without rate-limiter). Red: neither rate-limiter nor chain-pause control available — exploit blast radius equals full bridge TVL. Gray: protocol does not have a bridge component (factor is N/A).
Common gray cases
The rate-limiter exists but its cap is dynamically configurable by an admin role without timelock — the assessment depends on current cap, not nominal presence of the mechanism.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor. The reference positive case is Dango (Apr 2026), where a per-window rate-limiter capped post-exploit outflow at $410K out of a $1.9M attempted drain, and a validator-executed chain pause then froze the remaining $1.49M in place — yielding near-100% recovery and demonstrating both controls operating in sequence.
Measurement what to look for#
Determine whether the bridge implements a per-window outflow rate-limiter (and at what cap), and whether the protocol team can trigger a chain-level or validator-set emergency pause.