Summary
Ketju does not approve the Robinhood Chain bridge: only whitelisted validators can dispute an invalid state, a filter can block even transactions forced in through Ethereum, and an externally owned account can still upgrade critical contracts. Robinhood Chain is an Arbitrum Orbit L2 that Robinhood runs for tokenized stocks and other RWA products. Robinhood documents the chain unusually well at the contract level, and that documentation shows these three weaknesses. The filter defeats force-inclusion, the last-resort protection that every other canonical bridge Ketju reviews relies on. L2Beat flags the upgrade power of the externally owned account as a critical risk. Robinhood restructured governance four weeks before this review. The change improved the main multisig and closed none of the three gaps.
Review triggers
- Fraud-proof validation opens to anyone, removing the whitelisted-validator requirement
- The ArbFilteredTransactionsManager filter is removed, or is shown never to block a transaction forced in through L1
- The externally owned account that now holds direct upgrade or admin permission is removed from that role, leaving only the disclosed multisig
- Twelve months in a row under the restructured multisig governance with no upgrade that skips the timelock and lacks public justification
Facts
- Verdict
- Not approved
- Type
- Other
- Chains examined
- Ethereum
- Reviewed
- Last confirmed