Worked example · 2022-20

Optimism L1-to-L2 cross-chain governance relay gap — Ethereum / Optimism — 2022–2025 (architecture-review)

Loss: structural — no direct dollar extraction attributable to the governance relay gap alone as of v0.1. The Optimism governance relay between L1 (Ethereum Governor Bravo contracts) and L2 (Optimism execution) carries a structural T10.006 surface documented at the architecture-review and audit-finding layer. The gap is between the governance model's architectural assumption (L1 governance decisions are faithfully relayed to L2 execution) and the operational reality (the multisig-controlled relay infrastructure can execute on L2 in ways not verifiably constrained by L1 governance events).
OAK Techniques observed: OAK-T10.006 (Cross-Chain Governance Relay Attack) — primary; the Optimism governance architecture involves L1 governance contracts (Token House + Citizens' House) whose decisions must be relayed to L2 for execution via the Optimism bridge and the Security Council multisig. The relay surface — the message path from L1 governance approval to L2 execution — is gated by a multisig (Security Council) and a bridge message relay, not by an on-chain verifiable governance-event binding. OAK-T9.003 (Governance Attack — single-chain) — structurally adjacent; if the L1 governance process is captured, the relay faithfully propagates the captured decision to L2.
Attribution: unattributed The gap is documented in L2BEAT stage-classification analyses, Optimism governance documentation, and audit-firm advisories on cross-chain governance relay security.
Key teaching point: An L2 governance relay whose L2 execution is gated by a multisig rather than by verifiable on-chain binding to an L1 governance event is a T10.006 surface — the multisig can execute on L2 in ways that do not correspond to any verifiable L1 governance proposal, even if the multisig signers are operating in good faith. The structural lesson is that governance relay infrastructure should encode the L1 governance event on-chain (proposal ID, proposal parameters, source-chain finality) and verify it at the target-chain executor before execution, rather than relying on a multisig to faithfully relay the governance intent.

Summary

Optimism is an optimistic rollup on Ethereum whose governance is structured as a bicameral system: the Token House (OP token-holder governance via Governor Bravo contracts on L1 Ethereum) and the Citizens' House (retroactive public-goods funding allocation). Governance decisions approved on L1 — protocol upgrades, parameter changes, treasury allocations — must be executed on L2 (Optimism) to take effect. The execution path involves: L1 governance approval via bridge message relay (L1-to-L2) followed by L2 execution. The relay is gated by the Optimism Security Council, a multisig of community members and Optimism Foundation representatives who are responsible for shepherding approved governance proposals to L2 execution.

The T10.006 surface is the gap between the governance model's specification and the relay's operational design:

Multisig-gated execution without on-chain governance-event binding. The Security Council multisig executes governance actions on L2 by signing and submitting transactions. The L2 executor contract does not independently verify that the multisig's action corresponds to a verifiable L1 governance event — it trusts the multisig to faithfully relay the approved proposal. If the multisig were compromised, an attacker could execute arbitrary L2 governance actions that appear legitimate at the L2 executor layer but have no corresponding L1 governance proposal.
Timelock asymmetry. L1 governance proposals on Optimism are subject to a voting period and timelock, but the L2 execution — once the multisig signs — may not carry an equivalent timelock on the L2 side. The structural asymmetry means an attacker who compromises the multisig can execute on L2 faster than the L1 governance cycle would normally permit.
Upgrade-authority concentration. The Security Council holds upgrade authority over the L2 system contracts (bridge, sequencer, dispute game). An L1 governance proposal to upgrade these contracts must pass through the multisig relay; a compromised multisig could upgrade the L2 contracts to an attacker-controlled implementation that appears to downstream consumers as a legitimate Optimism upgrade.

These gaps have not resulted in a dollar-loss extraction from the Optimism governance relay as of v0.1. The Security Council has operated without compromise, and L1 governance proposals have been faithfully relayed to L2 execution. However, the T10.006 surface is structural and applies to any L2 whose governance relay is gated by a multisig rather than by on-chain verifiable governance-event binding. The gap is documented in L2BEAT's stage-classification analyses, which flag multisig-controlled upgrades as a Stage 0/Stage 1 characteristic and require on-chain verifiable governance binding for Stage 2 classification.

The L2 ecosystem's broader adoption of cross-chain governance relays — Optimism's Superchain governance, Arbitrum's DAO + Security Council model, Polygon's L1-to-L2 governance bridge — means the T10.006 surface is expanding as more governance decisions cross chains. The Optimism case is the canonical architecture-review anchor because it is the most commercially-significant L2 with a bicameral governance system and a multisig-gated relay, and its governance architecture is well-documented in public materials.

Timeline (UTC)

When	Event	OAK ref
2021-12	Optimism mainnet launch; initial governance operated by Optimism Foundation multisig (no token-holder governance)	(pre-T10.006 surface)
2022-05	OP token launched; Token House governance established on L1 Ethereum via Governor Bravo contracts; Security Council multisig serves as L1-to-L2 governance relay	T10.006 surface created (multisig-gated relay without on-chain governance-event binding)
2023–2024	Citizens' House established; bicameral governance matures; governance relay structure remains multisig-gated	T10.006 surface persists
2023–2025	L2BEAT publishes stage classifications flagging multisig-controlled upgrades as a Stage 0/Stage 1 characteristic; on-chain verifiable governance binding required for Stage 2	T10.006 surface characterised in public stage-classification framework
2024–2025	Optimism Superchain governance expands across OP Stack chains (Base, Zora, Mode, etc.); cross-chain governance relay surface broadens to multi-chain governance	T10.006 surface expansion
Continuing	Security Council operates without incident; no governance-relay bypass at extraction scale; gap is structural and pre-exploitation	T10.006 surface monitoring ongoing

Realised extraction

$0 at the named-exploit level as of v0.1. The gap is documented at the architecture-review layer.

Public references

Optimism governance documentation — Token House, Citizens' House, and Security Council governance architecture.
L2BEAT stage-classification analyses — flag multisig-controlled upgrades and governance-relay structures as stage-classification criteria.
Optimism Security Council mandate and composition — public documentation of multisig signer set and authority scope.
Cross-reference: T10.006 at techniques/T10.006-cross-chain-governance-relay-attack.md.
Cross-reference: examples/2024-07-compound-cross-chain-governance-relay.md — Compound cross-chain governance relay misconfiguration (audit-finding class).
Cross-reference: examples/2023-2024-layerzero-governance-relay-misconfiguration-audit-cohort.md — LayerZero OFT governance relay misconfiguration cohort.

Discussion

The Optimism governance relay is the canonical T10.006 architecture-review anchor for L2 governance infrastructure. The case demonstrates that cross-chain governance relay surfaces are not confined to third-party bridge protocols (LayerZero, Wormhole) — L2-native governance relays (Optimism's L1-to-L2 bridge, Arbitrum's DAO + Security Council, Polygon's governance bridge) carry structurally identical T10.006 surfaces when the L2 execution is gated by a multisig rather than by on-chain verifiable binding to an L1 governance event.

Three structural observations:

Multisig-gated governance relay is the current industry baseline for L2 governance — and it is a T10.006 surface by default. Every L2 whose upgrade authority is held by a multisig that relays L1 governance decisions to L2 execution carries a T10.006 surface. The surface is present regardless of the multisig's trustworthiness because the gap is structural (the L2 executor does not independently verify the L1 governance event) rather than reputational (the multisig signers are trusted individuals). Risk teams integrating L2s should treat multisig-gated governance relays as a standing T10.006 surface and track the L2's progress toward on-chain governance-event binding as the primary mitigation maturity metric.
L2BEAT stage classification is a defender-side T10.006 detection instrument. The stage-classification framework publishes per-L2 assessments of upgrade-authority concentration, timelock constraints, and governance-relay structures. Stage 2 classification requires on-chain verifiable governance binding — the canonical T10.006 mitigation. Risk teams can use L2BEAT stage classifications as a public, independently-maintained T10.006 surface inventory for every major L2.
The blast radius of a T10.006 compromise on an L2 governance relay is the entire L2's system contracts, not a single bridge's asset pool. A compromised L2 governance relay allows the attacker to upgrade the L2's bridge, sequencer, and dispute-game contracts — effectively capturing the L2's entire execution environment. This blast-radius scaling is qualitatively different from a single-bridge governance-relay compromise (T10.002 scale, bounded to the bridge's TVL) and is the structural reason L2 governance-relay surfaces should be treated as a distinct risk tier.