OAK — OnChain Attack Knowledge

Worked example · 2023-09

Stargate / LayerZero cross-chain governance relay multisig configuration — bridge parameter update relay path — multi-chain — 2023–2024

Loss
structural — no exploited extraction at Stargate through the v0.1 cutoff. The loss is measured in the governance-relay risk surface that the multisig-controlled parameter-update path represents: a compromise of the governance multisig or a relay misconfiguration would allow an attacker to update bridge parameters (fee schedules, supported-chain registry, token-supply caps) to enable asset extraction. The governance-relay surface was identified in third-party audits and community security reviews; it remained an unexercised risk rather than an exploited vulnerability through v0.1.
OAK Techniques observed
OAK-T10.006 (Cross-Chain Governance Relay Attack — the multisig-controlled bridge-parameter-update relay path: the governance multisig on the governance chain signs parameter-update messages that are relayed via LayerZero's cross-chain messaging to the Stargate contracts on each supported chain. A multisig-key compromise, a relay-message forgery, or a governance-process manipulation on the governance chain would enable an attacker to update bridge parameters on all supported chains with a single governance-relay transaction). The surface is structurally analogous to the Compound cross-chain governance relay case (2024-07, see examples/2024-07-compound-cross-chain-governance-relay.md) — a governance multisig on a single chain controls protocol parameters on multiple chains via a cross-chain relay — but at the bridge layer rather than the lending-protocol layer.
Attribution
unattributed — structural / design-level. The governance-relay surface was identified by auditors and community researchers; no exploitation has been attributed through v0.1.
Key teaching point
Cross-chain governance relay via multisig creates a single-compromise surface for multi-chain protocol parameter control. The Stargate governance architecture — a multisig on a single governance chain controls bridge parameters (fee schedules, chain registry, token caps) on every supported chain via LayerZero cross-chain messages — means that a multisig-key compromise or relay-message forgery on the governance chain propagates to every chain Stargate is deployed on. The governance-relay path converts a single-chain multisig-compromise into a multi-chain protocol-compromise, and the relay's correctness depends on the multisig signer set, the relay message verification, and the governance-chain finality — a three-link chain whose weakest link determines the security of bridge parameters on all chains.

Summary

Stargate Finance, built on LayerZero's cross-chain messaging protocol, is a cross-chain liquidity bridge deployed across Ethereum, Arbitrum, Optimism, Polygon, BNB Chain, Avalanche, and other EVM chains. The bridge's core parameters — fee schedules, supported-chain registry entries, per-token supply caps, pool-weight allocations — are governed by a multisig that signs parameter-update messages on the governance chain (Ethereum mainnet). These messages are relayed via LayerZero's cross-chain messaging to the Stargate contracts on each supported chain, where they are executed as parameter updates.

The governance-relay architecture creates a structural T10.006 surface: the governance multisig is the single point of control for bridge parameters on all chains. A compromise of the multisig, a relay-message forgery (if the LayerZero relayer set or message-verification oracle is subverted), or a governance-process manipulation on the governance chain (e.g., a malicious proposal that passes the multisig with a fraudulent parameter-update payload) would propagate to every Stargate deployment. The blast radius — every chain's bridge parameters controllable from a single governance-chain multisig — is the defining T10.006 characteristic.

The Stargate governance relay was reviewed by third-party auditors and community security researchers in 2023–2024. Audit reports identified the governance-relay surface and recommended mitigations (timelock delays on parameter updates, per-chain parameter caps, multi-signer threshold upgrades). Through the OAK v0.1 cutoff, the surface remained an unexercised risk — no exploitation event has been publicly attributed to the Stargate governance relay — but the structural exposure is the canonical bridge-layer T10.006 case alongside the lending-protocol-layer Compound case.

Timeline (UTC)

When Event OAK ref
2022-03 Stargate Finance launches on LayerZero; governance multisig controls bridge parameters across supported chains T10.006 (surface creation)
2023-2024 Third-party auditors and community researchers identify and document the governance-relay surface; Stargate implements recommended mitigations (timelock delays, per-chain parameter caps) T10.006 (surface identified, mitigated)
Continuing Governance-relay surface remains an unexercised risk through v0.1; no exploitation event publicly attributed T10.006 (unexercised risk)

What defenders observed

  • The governance-relay path converts single-chain compromise into multi-chain blast radius. The governance multisig on Ethereum mainnet controls bridge parameters on every Stargate-supported chain. A multisig-key compromise on Ethereum propagates to every chain via the LayerZero relay, and a single malicious parameter-update message can update fee schedules or token-supply caps on all chains simultaneously. Defenders evaluating bridge security should treat the governance-relay path as the highest-leverage attack surface and should assess the multisig signer set, the relay-message verification oracle, and the governance-chain finality as a single three-link security chain.
  • Timelock delays and per-chain parameter caps are the load-bearing mitigations. The standard T10.006 mitigation — a timelock delay between governance-relay message submission and parameter-update execution — gives defenders a detection-and-response window during which a malicious parameter update can be observed and contested before it takes effect. Per-chain parameter caps (e.g., a per-chain maximum fee increase, a per-chain token-supply ceiling) bound the damage a single governance-relay compromise can cause on any given chain. Both mitigations were recommended in Stargate's audit reports and partially implemented through the 2023–2024 window.
  • The governance chain is the single highest-value target in the multi-chain deployment. Because the governance multisig resides on Ethereum mainnet, an attacker who compromises the multisig's signer keys does not need to attack any other chain — the relay path propagates the malicious update to every supported chain automatically. This property inverts the usual multi-chain security assumption (that compromising multiple chains requires compromising each chain independently) and concentrates the security of the entire multi-chain deployment on a single multisig on a single chain.

What this example tells contributors writing future Technique pages

  • Bridge-layer T10.006 is the structural complement to lending-protocol-layer T10.006. The Compound case (2024-07) documents cross-chain governance relay at the lending-protocol layer; the Stargate case documents the same surface at the bridge layer. The two cases together establish that T10.006 is a cross-vertical Technique — any protocol that deploys on multiple chains with a single-chain governance multisig controlling multi-chain parameters inherits the surface. Contributors writing future T10.006 examples should expect to find the surface across bridges, lending protocols, DEX aggregators, and any multi-chain DeFi protocol with centralised governance.
  • The unexercised-risk framing is load-bearing for T10.006. Not every T10.006 surface results in an exploitation event — the Stargate governance relay was identified, audited, and partially mitigated before any exploitation occurred. The unexercised-risk framing documents the surface honestly without over-claiming extraction, and it provides the defender-side value (identify the surface, assess the three-link security chain, implement timelock delays) that the worked-example template is designed around.

Public references

  • [stargatefinance2022] (proposed) — Stargate Finance launch and bridge architecture; the LayerZero-relayed governance-parameter-update mechanism.
  • [layerzerogovernance2023] (proposed) — LayerZero cross-chain governance relay documentation; the relayer set and message-verification oracle design.
  • [stargateaudit2023] (proposed) — Third-party audit reports identifying the governance-relay surface and recommending timelock delays and per-chain parameter caps.

Discussion

The Stargate / LayerZero governance relay multisig is the canonical bridge-layer T10.006 case at v0.1, complementing the lending-protocol-layer Compound case (2024-07). The two cases together establish T10.006 as a cross-vertical Technique: any protocol deploying on multiple chains with single-chain governance controlling multi-chain parameters inherits the governance-relay surface, and the three-link security chain (multisig signer set → relay-message verification oracle → governance-chain finality) is the load-bearing analytical framework.

The Stargate case is documented as an unexercised risk — a governance-relay surface that was identified, audited, and partially mitigated before exploitation — rather than as an exploitation event. The unexercised-risk framing is deliberate: T10.006's defender-side value includes identifying governance-relay surfaces that have not yet been exploited, and documenting an audited-but-unexploited case alongside an exploited case (Compound) provides the full risk-spectrum coverage that the OAK worked-example template is designed around.

Techniques demonstrated (1)