Bridge uses same key custody for >30% validators

PancakeSwap's assessment for RD-F-156 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Under default LayerZero V1 configuration, effectively 100% of functional validators (oracle + relayer) are operated by LayerZero Labs. Factor threshold is >30% same custodian — this exceeds that threshold. However this reflects V1 architecture default, not PancakeSwap's specific config choice. No evidence of custom oracle/relayer separating operators.

Sources #

URL
Composable Security — LayerZero integrationSearch: LayerZero Labs operates default oracle and relayer for V1; custom config rarely implementedretrieved 2026-04-28

Methodology #

Determine whether >30% of bridge validators share a single key custodian.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol pancakeswap factor RD-F-156 score yellow collected_at 2026-04-28 19:10:57