Building on the Technical Asset Listing Framework above, we want to share additional detail on its Bridge and Cross-Chain Risk section. The aim is to evaluate the bridge configuration on every route, meaning any connection between two networks, whether incoming, outgoing, or both, by which it can reach an Aave deployment, independent of any single bridge design.
The methodology evaluates each route against a common set of criteria. Without going into the specifics of any particular design, the criteria cover:
-
Verification thresholds and trusted verifiers. The set of verifiers that must attest to a message, on both the sending and the receiving leg of every route, and the quorum that would be required to forge one. Routes that resolve to a single effective verifier, or to confirmation depths too shallow to resist chain reorganizations, are below bar.
-
Verifier count and independence. Beyond the threshold, the number of verifiers and their operational independence, and whether a single verifier set applies to every asset and route or can be configured separately. Verifiers operated by the same entity, or co-located on shared infrastructure, collapse to a single effective verifier regardless of the nominal count.
-
Non-default, non-unilateral configuration. Whether the security configuration a route relies on, such as the pinned libraries, the verifier set, and the confirmation thresholds, is explicitly set rather than inherited from a mutable default, and who can change it, be it the asset issuer, the bridge operator, or a third party, and whether they can do so without the asset issuer’s consent.
-
Governed bridge ownership and admin authority. Whether the owner or admin that controls the bridge and each route’s configuration is a governance contract or a multisig, with a sufficient signing threshold and a timelock for critical changes (24 hours acceptable, 48 hours preferred), rather than a single externally owned account (EOA).
-
Scoped secondary roles. Any delegate or secondary manager that can alter configuration, rate limits, or the verifier quorum is held to the same governance and timelock standard, with a clearly bounded scope.
-
Governed upgrade control. Where bridge contracts are upgradeable, the upgrade authority is governed and timelocked on the same basis, so the underlying logic cannot be replaced without warning.
-
Conformant code. Deployments use the audited, canonical version of the bridge code, keep any custom variants minimal, and have all relevant contracts verified on public explorers.
-
Supply integrity and rate limiting. Mint and burn flows are correct and subject to rate limits, and, for designs that lock collateral on an origin chain to back a representation minted elsewhere (a lockbox model), the locked balance covers the sum of representations across all destinations plus transfers in flight at all times. A shortfall against that invariant signals that more has been minted than is locked, or a drain.
In practice, the outcome of this bridge assessment feeds the rating of the cross-chain section in our published asset technical assessments, so an asset’s cross-chain posture is reflected transparently alongside the rest of its technical profile.
This technical baseline is designed to sit beneath the broader, layered standards that LlamaRisk has put forward in the Aave Risk Framework, providing the repeatable cross-chain review that complements its asset, monitoring, and chain risk layers. We look forward to coordinating with LlamaRisk, asset issuers, and the wider community as both frameworks move toward adoption.