Bridge rate-limiter / chain-pause as positive mitigant
Hyperlane's assessment for RD-F-185 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No per-window outflow rate-limiter found in Mailbox or Warp Route source. HypERC20Collateral.sol and HypNative have no rate-limit logic. The ISM architecture allows validators to cease attestation (liveness failure mode, not a rate limit). No chain-pause capability documented for Ethereum or BSC Mailbox. Absence of this mitigant is a negative finding for F185 — rated red given $132M TVS and the open ERC4626 vulnerability (GitHub issue #8589) providing a concrete attack path this mitigant would otherwise limit.
Sources #
- GitHub
Methodology #
Determine whether the bridge implements a per-window outflow rate-limiter (and at what cap), and whether the protocol team can trigger a chain-level or validator-set emergency pause.
See the full factor methodology and distribution across all protocols →