Guardian/pause-keeper distinct from upgrader

Hyperliquid's assessment for RD-F-034 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Lockers role (2-of-5) is distinct from proxy admin upgrader role. Lockers can pause bridge but cannot upgrade implementation. Cold validators execute emergencyUnlock but cannot upgrade Bridge2. Structural role separation confirmed within Bridge2 contract.

Sources #

GitHub
Bridge2.sol constructor — hot/cold validator parametersBridge2.sol sourceretrieved 2026-04-28
URL
Hyperliquid layered validator model with role separationQuillaudits analysisretrieved 2026-04-28

Methodology #

Determine whether a pauser/guardian role exists and is held by an address distinct from the upgrader address.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol hyperliquid factor RD-F-034 score green collected_at 2026-04-28 13:58:49