Bridge uses same key custody for >30% validators
Curve Finance's assessment for RD-F-156 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
FastBridge 2-of-2: LayerZero Labs + SwissStake — two separate entities, different key custody, <30% concentration per entity. Green for FastBridge. CRV OFT (xDAO): if single-DVN = LayerZero Labs, 100% of validation is held by one entity (>30% threshold exceeded). Net: yellow (one surface acceptable, xDAO surface likely exceeds threshold if single-DVN is confirmed).
Sources #
- URLHypernative: KelpDAO Observation Layer ExploitHypernative analysis: 47% of LZ apps pre-incident were single-DVN (one operator controls all validation)retrieved 2026-04-28
- Curve Resources cross-chain overviewCurve FastBridge DVN: LayerZero Labs + SwissStake, two independent entitiesretrieved 2026-04-28
Methodology #
Determine whether >30% of bridge validators share a single key custodian.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol curve-v2 factor RD-F-156 score yellow collected_at 2026-04-28 19:48:40