Control profile
- Transaction ordering
- Permissioned validator set — 21 validators as of March 2026 (16 at launch)
- Escape hatch
- None independent of the validator set. The native bridge is operated BY those validators, so bridge security and chain security are the same assumption.
- Upgrade authority
- Centralised governance. Core code is not open source.
- Liveness record
- Fast finality by design; that is the tradeoff being made.
Ketju assessment
REJECTED for this client. Genuinely impressive engineering and the fastest-growing venue in the survey, but the properties are wrong for a sovereignty or diversification sleeve. Twenty-one validators, closed-source core, and — the decisive part — a native bridge operated by that same permissioned validator set. Bridge risk and chain risk are not independent, so there is no diversification benefit to be had between them. If a threshold of validators were compromised or coerced, assets bridged in are at risk with no separate recourse. Given the April 2026 lesson that the bridge IS the security model for any wrapped asset, a chain whose bridge is its validator set concentrates exactly the risk we now know to look for. Disposes of kinetiq-khype (~$0.78B) and hyperlend (~$0.43B).
Observable review triggers
- n/a — rejected
These triggers make the judgment monitorable. They are not predictions; each identifies a fact that would revoke or force review of the current assessment.
Advisor implementation questions
- Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
- Can the client exit without cooperation from the normal transaction-ordering party?
- Who can upgrade bridges or contracts, and what delay applies?
- Does the asset introduce an issuer weaker than the chain grade?
- What evidence will show a halt, censorship event, or governance change?