Axeline Bridge
General-purpose cross-chain messaging with pluggable verifiers.
A messaging layer that delivers arbitrary payloads between Optimism, Avalanche and Arbitrum. Applications choose a verifier (multisig attestation or light-client proof); an executor delivers messages to receiver contracts.
- Ecosystem
- Optimism, Avalanche, Arbitrum
- Category
- Interoperability
- Languages
- Solidity
- Launched
- Oct 2025
Grade BB · Elevated risk
Moderate risk; several areas need remediation.
+0.2 since Nov 2025 · +2.6 since Jul 2026
Quantix Protocol Research · as of 24 Oct 2026 · About this data
Risk Index
How the score is built
| Component | Weight | Value | Points | Gap |
|---|---|---|---|---|
| Code Security | 30% | 68 | 20.4 | −9.6 |
| Operational Security | 20% | 72 | 14.4 | −5.6 |
| Governance Risk | 15% | 70 | 10.5 | −4.5 |
| Economic Security | 15% | 76 | 11.4 | −3.6 |
| Infrastructure Resilience | 10% | 70 | 7.0 | −3.0 |
| Transparency | 10% | 78 | 7.8 | −2.2 |
| Quantix Risk Index | 100% | 71.5 | −28.5 |
| Component | Axeline Bridge |
|---|---|
| Code | 68 |
| Operational | 72 |
| Governance | 70 |
| Economic | 76 |
| Infrastructure | 70 |
| Transparency | 78 |
Grade scale
- AAA90–100
- AA85–89.9
- A80–84.9
- BBB75–79.9
- BB70–74.9
- B65–69.9
- CCC60–64.9
- CC55–59.9
- C50–54.9
- D0–49.9
Score history
12 monthly snapshots
| Period | Quantix Risk Index |
|---|---|
| Nov ’25 | 71.3 |
| Dec ’25 | 71.3 |
| Jan ’26 | 71.3 |
| Feb ’26 | 71.3 |
| Mar ’26 | 71.3 |
| Apr ’26 | 71.3 |
| May ’26 | 71.3 |
| Jun ’26 | 71.3 |
| Jul ’26 | 68.9 |
| Aug ’26 | 71.5 |
| Sep ’26 | 71.5 |
| Oct ’26 | 71.5 |
28 Aug 2026
Research assessment
Research assessment completed: Bridge Security Assessment
8 findings (1 critical, 3 high, 2 medium, 1 low, 1 informational). 2 critical or high findings remain open.
Read the research assessment- Code Security+3
- Transparency+1
12 Aug 2026
Upgrade
Chain IDs bound into message hashes
Domain separation across source and destination chains.
- Code Security+4
- Operational Security+2
22 Jul 2026
Incident analysis
Cross-chain message replayed on a second destination
Verifier v1 digests did not commit to the destination chain, so two Avalanche deliveries were accepted again on Arbitrum.
Incident analysis in Threat Analysis- Code Security−8
Risk factors
HighCode SecurityFrom the research assessment
2 open critical or high findings
The research assessment reports 0 critical and 2 high findings still open or partially resolved. Code Security reflects this exposure until fixes are verified.
HighCode SecurityProfile analysis
Application-chosen security
Applications can configure weak verifiers; one weak application can be drained without affecting others, but users rarely see the setting.
MediumCode SecurityProfile analysis
Unbounded retries
Retrying failed deliveries without expiry can execute stale messages under changed conditions.
Recommendations
Code Security: 68 → 78
Enforce a minimum attestation threshold
Reject verifier configurations below 3 attesters.
+3.0
→ 74.5
Economic Security: 76 → 80
Expiry for retried messages
Add a deadline to message payloads and reject expired retries.
+0.6
→ 72.1
Analysis
Contract, governance and operations
Contract analysis
- Source
- Verified
- Upgradeability
- Transparent proxy
- Administrative control
- Axeline multisig (4-of-6), 24-hour delay
- Enforced delay
- 24 hours
- External dependencies
- Attesters; Executor network; Light-client verifiers
- CautionVerifier choice. Applications choose their verifier and threshold.
- FailMinimum threshold. A 1-of-1 attestation configuration is accepted.
- PassChain binding. Message hashes bind source and destination chain IDs since August 2026.
- CautionExecutor retries. Failed deliveries can be retried by anyone without expiry.
Governance exposure
Moderate
Protocol upgrades pass a 24-hour delay; application verifier settings are changed by each application owner.
Operational resilience
Adequate
Replay-detection rules added after the July incident.
Monitoring
Monitoring history
- 20 Oct 2026MediumAttester set rotated from 5 to 7 membersConfiguration Change · VerifierRegistryResolved
- 23 Jul 2026MediumExecutor unpaused after verifier migrationConfiguration Change · ExecutorResolved
- 22 Jul 2026HighVerifier v2 made the default for every applicationConfiguration Change · VerifierRegistryResolved
- 22 Jul 2026High14 further replay attempts rejectedSuspicious Transaction Pattern · EndpointResolved
- 22 Jul 2026MediumExecutor paused on ArbitrumConfiguration Change · ExecutorResolved
- 22 Jul 2026HighaxUSD outflow at 118% of the window limitWhale Activity · ExecutorResolved
Research assessment
QX-TSA-2026-012Bridge Security AssessmentUnder Review
Endpoint, verifier registry, attestation verifier, executor and message codec, as deployed on Optimism, Avalanche and Arbitrum. 2,386 nSLOC of Solidity.
Review 27 Jul 2026 – 28 Aug 2026
- 3 resolved
- 2 partially resolved
- 1 acknowledged
- 2 open
Continue with
- Monitoring timelineRecorded security events for Axeline Bridge
- Cross-chain message replay on a second destinationCase study
- Cross-chain message replayed on a second destinationIncident analysis · 22 Jul 2026
- Risk Index methodologyWeights, grade bands and calculator
Comparable protocols
- Ferrous HubInteroperability · CosmosA82.9
- Ostrander OptionsOptions · OptimismB68.2
- Thessaly GovernanceGovernance · OptimismBBB77.6
Research
Relevant research
Architecture
System components
- Endpoint
- Sends and receives messages with nonces
- VerifierRegistry
- Per-application verifier configuration
- AttestationVerifier
- Threshold signatures from attesters
- Executor
- Delivers verified messages and retries failures
Turn risk factors into a remediation plan.
A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.