Rollup multisig risk: upgrade keys can still misappropriate funds
Thread206 words
Explains how multisigs able to upgrade a rollup create security risk: even a zk rollup with a decentralized sequencer set can lose funds if a few signers control upgrades. Applies to smart contract rollups, not sovereign rollups.
Key claims
Multisig upgrade keys let a small group misappropriate funds in a smart contract rollup
The risk does not apply to sovereign rollups
0/ if you haven't yet, make sure to check out the weekly must read covering the modular ecosystem from last week 🧱✨
my personal highlight this week is the discussion around rollup multisigs 🔐
find a summary below 🧵👇
x.com/modularmedia_/status/1658540371104927746?s=20
1/ multi-signature wallets in the context of rollups are wallets capable of facilitating #rollup upgrades
2/ the existence of multisigs can has important security implications:
3/ let's consider rollup A, which operates smart contracts on #Ethereum L1
4/ let's assume rollup A holds a Total Value Locked (TVL) of $1 billion
5/ the rollup can be upgraded by three team members using a multi-signature wallet
6/ It's crucial to understand that even in the context of a zero knowledge (zk) rollup with a decentralized sequencer set...
7/ ...these individuals possess the power to misappropriate funds, highlighting the need for diligence and caution
8/ it's important to note though, that this scenario is specifically pertaining to smart contract rollups and not sovereign #rollups
9/ what's the difference between smart contract rollups and sovereign rollups?
check here 👇
x.com/CelestiaOrg/status/1633533630227300352
10/ for more detail, make sure to check out the weekly rollup linked above that also covers some other interesting modular topics or check out the below thread:
x.com/modularmedia_/status/1659003559671894016