Search

Search for projects by name

SummaryValue SecuredOnchain costsMilestones & IncidentsRisk summaryRisk analysisRollup stageTechnologyOperatorWithdrawalsPermissionsSmart contracts

Phala logoPhala

Badges

About

Phala is cloud computing protocol which aims at offering developers a secure and efficient platform for deploying and managing AI-ready applications in a trusted environment (TEE). Phala rollup on Ethereum leverages the Op-Succinct stack, a...

Value secured
$3.44 K427%
Canonically Bridged
$3.44 K
Externally Bridged
$0.00
Natively Minted
$0.00
View TVS Breakdown
  • Tokens
  • Daily UOPS
    0.000.00%
  • 30D ops count
    65.00
  • Stage
    Stage 0
  • Type
    ZK Rollup
  • Purpose
    Universal
    • Sequencer failureState validationData availabilityExit windowProposer failure

    Badges

    About

    Phala is cloud computing protocol which aims at offering developers a secure and efficient platform for deploying and managing AI-ready applications in a trusted environment (TEE). Phala rollup on Ethereum leverages the Op-Succinct stack, a...

    Value Secured
    Canonical
    External
    Native
    Onchain costs
    Calldata
    Blobs
    Compute
    Overhead
    Milestones & Incidents

    Phala Network Launch

    2025 Jan 8th

    Phala Network is live on Ethereum mainnet.

    Learn more
    Risk summary

    Funds can be frozen if

    1. the permissioned proposer fails to publish state roots to the L1,
    2. in non-optimistic mode, the SuccinctGateway is unable to route proof verification to a valid verifier.

    MEV can be extracted if

    1. the operator exploits their centralized position and frontruns user transactions.
    Risk analysis
    Sequencer failureState validationData availabilityExit windowProposer failure

    Sequencer failure

    Self sequence

    In the event of a sequencer failure, users can force transactions to be included in the project’s chain by sending them to L1. There is a 12h delay on this operation.

    State validation

    ZK proofs (SN)

    SNARKs are zero knowledge proofs that ensure state correctness, but require trusted setup.

    Data availability

    Onchain

    All of the data needed for proof construction is published on Ethereum L1.

    Exit window

    None

    There is no window for users to exit in case of an unwanted regular upgrade since contracts are instantly upgradable.

    Proposer failure

    Cannot withdraw

    Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen.

    Rollup stage
    PhalaPhala is a
    Stage 0
    ZK Rollup.

    Learn more about Rollup stages
    Please keep in mind that these stages do not reflect rollup security, this is an opinionated assessment of rollup maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal.
    Technology

    Validity proofs ensure state correctness

    Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract. Through the SuccinctL2OutputOracle, the system also allows to switch to an optimistic mode, in which no proofs are required and a challenger can challenge the proposed output state root within the finalization period.

    • Funds can be stolen if in non-optimistic mode, the validity proof cryptography is broken or implemented incorrectly.

    • Funds can be stolen if optimistic mode is enabled and no challenger checks the published state.

    • Funds can be stolen if the proposer routes proof verification through a malicious or faulty verifier by specifying an unsafe route id.

    • Funds can be frozen if the permissioned proposer fails to publish state roots to the L1.

    • Funds can be frozen if in non-optimistic mode, the SuccinctGateway is unable to route proof verification to a valid verifier.

    1. Op-Succinct architecture

    Zero knowledge SNARK cryptography is used

    Despite their production use zkSNARKs are still new and experimental cryptography. Cryptography has made a lot of advancements in the recent years but all cryptographic solutions rely on time to prove their security. In addition zkSNARKs require a trusted setup to operate.

    1. Op-Succinct architecture

    All data required for proofs is published on chain

    All the data that is used to construct the system state is published on chain in the form of cheap blobs or calldata. This ensures that it will be available for enough time.

    1. BatchInbox - Etherscan address
    Operator

    The system has a centralized operator

    The operator is the only entity that can propose blocks. A live and trustworthy operator is vital to the health of the system.

    • MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

    1. SuccinctL2OutputOracle.sol - Etherscan source code, CHALLENGER address
    2. SuccinctL2OutputOracle.sol - Etherscan source code, PROPOSER address
    Withdrawals

    Regular exit

    The user initiates the withdrawal by submitting a regular transaction on this chain. When the block containing that transaction is proven the funds become available for withdrawal on L1. Once funds are added to the withdrawal queue, operator must ensure there is enough liquidity for withdrawals. If not, they need to reclaim tokens from Yield Providers.

    1. OptimismPortal.sol - Etherscan source code, proveWithdrawalTransaction function
    2. OptimismPortal.sol - Etherscan source code, finalizeWithdrawalTransaction function
    3. SuccinctL2OutputOracle.sol - Etherscan source code, PROPOSER check
    Permissions

    The system uses the following set of permissioned addresses:

    Guardian OpFoundationOperationsSafe

    Guardian is an actor allowed to pause deposits and withdrawals.

    Used in:

    Sequencer EOA 1

    Sequencer is an actor allowed to commit transactions from the current layer to the host chain.

    ConduitMultisig 0x4a49…A746
    • A Gnosis Safe with 4 / 9 threshold.
    • Can act on behalf of ProxyAdmin.
    • Can change the configuration of AddressManager (acting via ProxyAdmin) - set and change address mappings.
    • Can change the configuration of OPSuccinctL2OutputOracle - can toggle between the optimistic mode and not optimistic (ZK) mode.
    • Can change the configuration of SystemConfig - it can update the preconfer address, the batch submitter (Sequencer) address and the gas configuration of the system.
    • Can upgrade the implementation of L1StandardBridge (acting via ProxyAdmin) - upgrading the bridge implementation can give access to all funds escrowed therein.
    • Can upgrade the implementation of OptimismPortal, L1ERC721Bridge, OPSuccinctL2OutputOracle, SystemConfig, SuperchainConfig, OptimismMintableERC20Factory (acting via ProxyAdmin).

    Participants (9):

    0x5093…66280xA073…bda20xF331…647D0xF0B7…A4f00xa400…e6e40x3840…Fd5f0xa0C6…90380xefCf…dD5C0x4D80…5BAe

    Used in:

    OpFoundationOperationsSafe 0x9BA6…6b3A
    • A Gnosis Safe with 5 / 7 threshold.
    • A Guardian.

    Participants (7):

    GnosisSafe0x3041…16230xE7dE…d02e0xBF93…a2c80x4D01…6d150x7cB0…C54f0x9bbF…31aa

    Used in:

    SuccinctGatewaySP1Multisig 0xCafE…6878
    • A Gnosis Safe with 2 / 3 threshold.
    • Can change the configuration of SuccinctGateway - holds the power to affect the liveness and safety of the bridge - can transfer ownership, add and freeze verifier routes.

    Participants (3):

    0xBaB2…11260x72Ff…4f540x9395…8885
    GnosisSafe 0x42d2…9c64
    • A Gnosis Safe with 2 / 2 threshold.
    • Member of OpFoundationOperationsSafe.

    Participants (2):

    0xb237…97A50x4665…7429

    Used in:

    Smart contracts
    A diagram of the smart contract architecture
    A diagram of the smart contract architecture

    The system consists of the following smart contracts on the host chain (Ethereum):

    L1CrossDomainMessenger 0x1549…1544Implementation (Upgradable)

    Sends messages from host chain to this chain, and relays messages back onto host chain. In the event that a message sent from host chain to this chain is rejected for exceeding this chain’s epoch gas limit, it can be resubmitted via this contract’s replay function.

    ProxyAdmin 0x198A…Ab2E
    • Can be used to configure AddressManager - set and change address mappings.
    • Can be used to upgrade implementation of L1StandardBridge - upgrading the bridge implementation can give access to all funds escrowed therein.
    • Can be used to upgrade implementation of OptimismPortal, L1ERC721Bridge, OPSuccinctL2OutputOracle, SystemConfig, SuperchainConfig, OptimismMintableERC20Factory.
    SuccinctGateway 0x397A…dA9B

    This contract is the router for the bridge proofs verification. It stores the mapping between the identifier of the bridge circuit and the address of the onchain verifier contract.

    AddressManager 0x51D5…8c06

    Legacy contract used to manage a mapping of string names to addresses. Modern OP stack uses a different standard proxy system instead, but this contract is still necessary for backwards compatibility with several older contracts.

    L1StandardBridge 0x6A34…1521Implementation (Upgradable)Admin

    The main entry point to deposit ERC20 tokens from host chain to this chain. This contract can store any token.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    OptimismPortal 0x96B1…F51AImplementation (Upgradable)Admin

    The main entry point to deposit funds from host chain to this chain. It also allows to prove and finalize withdrawals. This contract stores the following tokens: ETH.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    L1ERC721Bridge 0xa010…36AFImplementation (Upgradable)Admin

    Used to bridge ERC-721 tokens from host chain to this chain.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    SP1Verifier 0xa27A…5E5D
    OPSuccinctL2OutputOracle 0xb454…55d8Implementation (Upgradable)Admin

    Contains a list of proposed state roots which Proposers assert to be a result of block execution. The SuccinctL2OutputOracle modifies the L2OutputOracle to support whenNotOptimistic mode, in which a validity proof can be passed as input argument to the proposeL2Output function.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    SystemConfig 0xeBf5…2571Implementation (Upgradable)Admin

    Contains configuration parameters such as the Sequencer address, gas limit on this chain and the unsafe block signer address.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    SuperchainConfig 0xeDe0…97B8Implementation (Upgradable)Admin

    This is NOT the shared SuperchainConfig contract of the OP stack Superchain but rather a local fork. It manages the PAUSED_SLOT, a boolean value indicating whether the local chain is paused, and GUARDIAN_SLOT, the address of the guardian which can pause and unpause the system.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    OptimismMintableERC20Factory 0xF8e8…515eImplementation (Upgradable)Admin

    A helper contract that generates OptimismMintableERC20 contracts on the network it’s deployed to. OptimismMintableERC20 is a standard extension of the base ERC20 token contract designed to allow the L1StandardBridge contracts to mint and burn tokens. This makes it possible to use an OptimismMintablERC20 as this chain’s representation of a token on the host chain, or vice-versa.

    Can be upgraded by:
    ConduitMultisig

    Upgrade delay: No delay

    Value Secured is calculated based on these smart contracts and tokens:

    The current deployment carries some associated risks:

    • Funds can be stolen if the contracts or their dependencies (e.g. SuccinctGateway) receive a malicious code upgrade. There is no delay on upgrades.