Obsidian Rollup
Optimistic rollup with a permissioned sequencer and fault proofs.
An Ethereum Layer 2 that posts transaction batches to L1, settles withdrawals after a challenge window and exposes a canonical bridge. The sequencer is operated by a single entity with a forced-inclusion path on L1.
- Ecosystem
- Ethereum
- Category
- Layer 2
- Languages
- Solidity, Go
- Launched
- Aug 2025
Grade A · Moderate risk
Sound posture; some improvements recommended.
+3.9 since Nov 2025 · −0.4 since Jul 2026
Quantix Protocol Research · as of 24 Oct 2026 · About this data
Risk Index
How the score is built
| Component | Weight | Value | Points | Gap |
|---|---|---|---|---|
| Code Security | 30% | 86 | 25.8 | −4.2 |
| Operational Security | 20% | 80 | 16.0 | −4.0 |
| Governance Risk | 15% | 76 | 11.4 | −3.6 |
| Economic Security | 15% | 84 | 12.6 | −2.4 |
| Infrastructure Resilience | 10% | 82 | 8.2 | −1.8 |
| Transparency | 10% | 90 | 9.0 | −1.0 |
| Quantix Risk Index | 100% | 83.0 | −17.0 |
| Component | Obsidian Rollup |
|---|---|
| Code | 86 |
| Operational | 80 |
| Governance | 76 |
| Economic | 84 |
| Infrastructure | 82 |
| Transparency | 90 |
Grade scale
- AAA90–100
- AA85–89.9
- A80–84.9
- BBB75–79.9
- BB70–74.9
- B65–69.9
- CCC60–64.9
- CC55–59.9
- C50–54.9
- D0–49.9
Score history
12 monthly snapshots
| Period | Quantix Risk Index |
|---|---|
| Nov ’25 | 79.1 |
| Dec ’25 | 79.1 |
| Jan ’26 | 81.3 |
| Feb ’26 | 83.4 |
| Mar ’26 | 83.4 |
| Apr ’26 | 83.4 |
| May ’26 | 83.4 |
| Jun ’26 | 83.4 |
| Jul ’26 | 83.4 |
| Aug ’26 | 83.4 |
| Sep ’26 | 82.2 |
| Oct ’26 | 83.0 |
6 Oct 2026
Operations
Administrator keys rotated
Keys moved to hardware security modules with new signers.
- Operational Security+4
14 Sept 2026
Incident analysis
Compromised upgrade signers schedule a malicious Portal upgrade
Two of three upgrade-multisig keys were taken from a CI-connected signing host; the timelock gave responders 48 hours and they needed three.
Incident analysis in Threat Analysis- Operational Security−6
17 Feb 2026
Upgrade
Permissionless fault proofs enabled
Anyone can challenge proposed outputs.
- Code Security+5
- Governance Risk+4
9 Jan 2026
Research assessment
Research assessment completed: Protocol Architecture Review
9 findings (1 critical, 1 high, 4 medium, 2 low, 1 informational). All critical and high findings addressed.
Read the research assessment- Code Security+6
- Transparency+4
Risk factors
HighGovernance RiskProfile analysis
Broad emergency upgrade path
The council can replace bridge and proof contracts immediately, bypassing the exit window users rely on.
MediumInfrastructure ResilienceProfile analysis
Centralised sequencing
A single sequencer can delay transactions and degrade liveness; forced inclusion mitigates censorship but not latency.
LowCode SecurityFrom the research assessment
1 lower-severity finding not fully resolved
Medium, low or informational findings remain open or partially resolved in the research assessment.
Recommendations
Governance Risk: 76 → 84
Narrow the emergency path
Limit no-delay actions to pausing; route all logic changes through the 8-day path.
+1.2
→ 84.2
Infrastructure Resilience: 82 → 88
Sequencer failover
Operate a second sequencer with automatic failover and published liveness metrics.
+0.6
→ 83.6
Analysis
Contract, governance and operations
Contract analysis
- Source
- Verified
- Upgradeability
- L1 contracts upgradeable by the security council
- Administrative control
- 4-of-7 security council; 8-day delay for standard upgrades since September 2026, none for emergencies
- Enforced delay
- 192 hours
- External dependencies
- Single sequencer operator; Ethereum L1 data availability
- PassFault proofs. Permissionless bisection fault proofs on output roots.
- PassForced inclusion. Users can force transactions through L1 if censored.
- CautionSequencer. One operator orders all transactions.
- CautionEmergency upgrades. The council can upgrade without delay in an emergency.
Governance exposure
Moderate
Standard upgrades wait eight days; the emergency path is broad and executes immediately.
Operational resilience
Adequate
Upgrade-administrator keys were rotated to hardware after the September incident.
Monitoring
Monitoring history
- 16 Sept 2026MediumPortal upgrade delay raised from 48 hours to 8 daysConfiguration Change · UpgradeTimelockResolved
- 15 Sept 2026MediumWithdrawal finalisation resumedConfiguration Change · PortalResolved
- 14 Sept 2026HighUpgrade multisig owners rotatedAccess Control · Upgrade multisigResolved
- 14 Sept 2026LowSecurity council cancels the scheduled upgradeGovernance · UpgradeTimelockResolved
- 14 Sept 2026MediumWithdrawal finalisation paused by the guardianConfiguration Change · PortalResolved
- 14 Sept 2026CriticalPortal upgrade scheduled to an unapproved implementationProxy Upgrade · UpgradeTimelockResolved
Research assessment
QX-TSA-2026-008Protocol Architecture ReviewPublished
L1 rollup contracts (batch inbox, output oracle, dispute game, portal), the v2 upgrade and the Go sequencer and batcher. 4,310 nSLOC.
Review 1 Dec 2025 – 9 Jan 2026 · published 5 Feb 2026
- 7 resolved
- 1 partially resolved
- 1 acknowledged
- 0 open
Continue with
- Monitoring timelineRecorded security events for Obsidian Rollup
- A compromised upgrade multisig and the delay that stopped itCase study
- Compromised upgrade signers schedule a malicious Portal upgradeIncident analysis · 14 Sept 2026
- Risk Index methodologyWeights, grade bands and calculator
Comparable protocols
- Quillon VaultsYield · EthereumA82.5
- Pellucid OracleOracle · EthereumA83.6
- Halcyra StablecoinStablecoin · EthereumAA86.1
Research
Relevant research
Architecture
System components
- BatchInbox
- Receives compressed batches from the sequencer
- OutputOracle
- Stores proposed L2 state roots
- DisputeGame
- Bisection fault proofs over disputed outputs
- Portal
- Deposits, withdrawal proving and finalisation
- Sequencer (Go)
- Orders transactions and builds batches
Turn risk factors into a remediation plan.
A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.