{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"cross_chain_messaging","evidenceReadAt":"2026-09-28","generatedAt":"2026-11-12","criteria":[{"id":"message_trust_model","label":"Message trust model","weight":35},{"id":"security_configurability","label":"Application configurable security","weight":25},{"id":"message_failure_record","label":"Forged and stuck message record","weight":25},{"id":"cost_per_message","label":"Cost per message","weight":15}],"providers":{"layerzero_v2":{"message_trust_model":{"s":5,"q":"Some chains have only one DVN provider currently deployed. | You should always set your DVN configuration explicitly. Defaults are placeholder configurations — they may be Dead DVNs that prevent message delivery, may include only a single DVN, and may change without notice.","u":"https://docs.layerzero.network/v2/concepts/modular-security/security-stack-dvns","d":"2026-09-28"},"security_configurability":{"s":9,"q":"This stack of multiple DVNs allows each application to configure a unique security threshold for each source and destination, known as X-of-Y-of-N | You should not assume a second DVN will appear in time for a launch.","u":"https://docs.layerzero.network/v2/concepts/modular-security/security-stack-dvns","d":"2026-09-28"},"message_failure_record":{"s":2,"q":"On April 18, 2026, attackers linked to North Korea’s Lazarus Group stole ~$292 million (116,500 rsETH) from KelpDAO’s LayerZero bridge. | rsETH was configured with a single verifier: the LayerZero Labs DVN.","u":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","d":"2026-09-28"},"cost_per_message":{"s":8,"q":"eth_call EndpointV2 0x1a44076050125825900e736c501f859c50fE728c quote((dstEid 30110, receiver 0x000000000000000000000000000000000000000000000000000000000000dead, message 0x0000000000000000000000000000000000000000000000000000000000000001, options 0x00030100110100000000000000000000000000030d40…","u":"https://docs.layerzero.network/v2/concepts/protocol/transaction-pricing","d":"2026-09-28"}},"wormhole-cross_chain_messaging":{"message_trust_model":{"s":6,"q":"Wormhole relies on a set of 19 distributed nodes called Guardians that monitor the state on several blockchains. | Some chains (such as Ethereum and Solana) are secured by all 19 Guardians. | A quorum of 13 signatures is required to produce a valid VAA.","u":"https://wormhole.com/docs/protocol/infrastructure/guardians/","d":"2026-09-28"},"security_configurability":{"s":3,"q":"Applications request automated delivery by submitting an execution request to the Executor contract, along with a signed fee quote obtained off-chain from a relay provider. | The Executor does not change Wormhole’s security model.","u":"https://wormhole.com/docs/protocol/infrastructure/relayers/relayer/","d":"2026-09-28"},"message_failure_record":{"s":3,"q":"The attacker exploited the use of a deprecated, insecure function to bypass signature verification and steal $326 million (120k wETH).","u":"https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022","d":"2026-09-28"},"cost_per_message":{"s":6,"q":"eth_call Wormhole Core 0x98f3c9e6E3fAce36bAAd05FE09d375Ef1464288B messageFee() = 0 at Ethereum block 25709399 and at block 26074794; WormholeRelayer 0x27428DD2d3DD32A4D7f7C497eAaa23130d894911 quoteEVMDeliveryPrice(23, 0, 200000) = (0, 0) at both blocks","u":"https://wormhole.com/docs/protocol/infrastructure/core-contracts/","d":"2026-09-28"}},"axelar":{"message_trust_model":{"s":6,"q":"The number of votes each validator may cast is equivalent to the square root of their stake. A threshold of validators, weighted by the square root of the stakes, then must collectively coauthorize every cross-chain request.","u":"https://docs.axelar.dev/learn/security/","d":"2026-09-28"},"security_configurability":{"s":4,"q":"Once the event sent by an external chain is received by Axelar, a poll is generated and Axelar validators vote on the poll. | The Gateway can only allow actions on the external chain if the number of validators holding key shares who authorize the action reaches a set threshold.","u":"https://docs.axelar.dev/learn/network/flow/","d":"2026-09-28"},"message_failure_record":{"s":7,"q":"Axelar’s core protocol was not affected. | did not verify the source channel of inbound IBC packets before minting","u":"https://www.commonprefix.com/blog/secret-network-exploit","d":"2026-09-28"},"cost_per_message":{"s":6,"q":"eth_call AxelarGasService 0x2d5d7d31F671F86C782533cc367F14109a082712 estimateGasFee(\"arbitrum\", \"0x000000000000000000000000000000000000dEaD\", 0x0000000000000000000000000000000000000000000000000000000000000001, 200000, 0x) at Ethereum block 25709399 = 93035040403958 wei; same call at block 26074794…","u":"https://docs.axelar.dev/dev/gas-service/intro/","d":"2026-09-28"}},"chainlink_ccip":{"message_trust_model":{"s":4,"q":"When the CCIP Owner manually initiates a curse, the curse() function is invoked to mark the appropriate subjects as cursed. | the Risk Management Network's automated offchain role is no longer active in current CCIP deployments","u":"https://docs.chain.link/ccip/concepts/architecture/onchain/evm/components","d":"2026-09-28"},"security_configurability":{"s":5,"q":"CCVs allow for composable security within CCIP. The v1 CCIP DON is now called the CommitteeVerifier and is still the safe, default option. | Verifiers are permissionless and require no registration.","u":"https://github.com/smartcontractkit/chainlink-ccip/releases/tag/contracts-ccip-v2.0.0","d":"2026-09-28"},"message_failure_record":{"s":8,"q":"eth_call Router 0x80226fc0Ee2b096224EeAc085Bb9a8cba1146f7D isChainSupported(selector) = true for Arbitrum One 4949039107694359620, Base 15971525489660198786, Optimism 3734403246176062136, Polygon 4051577828743386545, BNB Chain 11344663589394136015, Avalanche 6433500567565415381, Solana…","u":"https://docs.chain.link/ccip/concepts/architecture/onchain/evm/components","d":"2026-09-28"},"cost_per_message":{"s":3,"q":"eth_call Router 0x80226fc0Ee2b096224EeAc085Bb9a8cba1146f7D getFee(4949039107694359620, (receiver 0x000000000000000000000000000000000000000000000000000000000000dead, data 0x0000000000000000000000000000000000000000000000000000000000000001, tokenAmounts [], feeToken, extraArgs gasLimit 200000)) at…","u":"https://docs.chain.link/ccip/billing","d":"2026-09-28"}},"hyperlane":{"message_trust_model":{"s":5,"q":"eth_call Mailbox 0xc005dc82818d67AF737725bD4bf75435d065D239 defaultIsm() at Ethereum block 26074794 = 0xDD0998A3533b137a3520bca7c0Fb0b4F5886Ae82 (moduleType 2, modulesAndThreshold 2 of [0x2D3F4dd71811c1bF27DD42f2003eC9dA2E43D770 moduleType 6, 0x6478DfF746310a7B5C76379568c0e3a93f9a3FAA moduleType 1…","u":"https://docs.hyperlane.xyz/docs/protocol/ISM/modular-security","d":"2026-09-28"},"security_configurability":{"s":9,"q":"Developers can either use the Mailbox’s default ISM or specify their own application-specific ISM. | ISMs are fully customizable. Developers can write their own ISMs, tailoring them to the needs of their application.","u":"https://docs.hyperlane.xyz/docs/protocol/ISM/modular-security","d":"2026-09-28"},"message_failure_record":{"s":7,"q":"Details released by Humanity Protocol show that three of six Gnosis Safe owner keys controlling the Hyperlane bridge ProxyAdmin on Ethereum were compromised.","u":"https://crypto.news/humanity-protocol-says-compromised-admin-keys-led-to-36m-exploit/","d":"2026-09-28"},"cost_per_message":{"s":7,"q":"eth_call Mailbox 0xc005dc82818d67AF737725bD4bf75435d065D239 quoteDispatch(42161, 0x000000000000000000000000000000000000000000000000000000000000dead, 0x0000000000000000000000000000000000000000000000000000000000000001) at Ethereum block 25709399 = 51575044905397 wei; at block 26074794 =…","u":"https://docs.hyperlane.xyz/docs/protocol/core/interchain-gas-payment","d":"2026-09-28"}},"debridge-cross_chain_messaging":{"message_trust_model":{"s":5,"q":"the minimum required threshold of validators’ signatures is achieved | Validators work for and are elected by the governance","u":"https://docs.debridge.com/dmp-details/dmp/protocol-overview","d":"2026-09-28"},"security_configurability":{"s":2,"q":"The governance manages the parameters of the smart contracts, such as fees, supported chains, the whitelist of elected validators, validators payout ratio, and more.","u":"https://docs.debridge.com/dmp-details/dmp/protocol-overview","d":"2026-09-28"},"message_failure_record":{"s":7,"q":"eth_call DeBridgeGate 0x43dE2d77BF8027e25dBD179B491e8d64f38398aA paused() = false at Ethereum block 25709399 and at block 26074794; getChainToConfig(chainId).isSupported = true for 42161, 8453, 10, 137, 56, 43114, 59144 and false for 146, 80094, 100, 250 at both blocks","u":"https://docs.debridge.com/dmp-details/dmp/fees-supported-chains","d":"2026-09-28"},"cost_per_message":{"s":2,"q":"eth_call DeBridgeGate 0x43dE2d77BF8027e25dBD179B491e8d64f38398aA globalFixedNativeFee() = 1000000000000000 at Ethereum block 25709399 and at block 26074794; getChainToConfig(42161) = (fixedNativeFee 0, isSupported true, transferFeeBps 0) at both blocks","u":"https://docs.debridge.com/dmp-details/dmp/fees-supported-chains","d":"2026-09-28"}},"union":{"message_trust_model":{"s":6,"q":"eth_call ibc-union core 0xee4ea8d358473f0fcebf0329feed95d56e8c04d7 clientTypes(i), clientImpls(i) at Ethereum block 26077476: 1, 2, 3 = \"cometbls\" 0x7700eA295F62989d2c98721389a521C96Fe3c4C0; 4, 7, 8 = \"state-lens/ics23/ics23\"","u":"https://raw.githubusercontent.com/unionlabs/union/main/deployments/deployments.json","d":"2026-09-28"},"security_configurability":{"s":7,"q":"We currently support two categories of connections, direct and recursive. Each connection can leverage any of our light clients.","u":"https://docs.union.build/protocol/overview/","d":"2026-09-28"},"message_failure_record":{"s":6,"q":"Union's public mainnet is officially live. The initial set of mainnet validators are producing blocks on union-1","u":"https://union.build/blog/mainnet/","d":"2026-09-28"},"cost_per_message":{"s":4,"q":"All deployments of the ibc-union stack, light clients, ucs* apps, and other miscellaneous contracts deployed by on Union.","u":"https://docs.union.build/protocol/deployments/","d":"2026-09-28"}}}}