DVN detection (bridge security)

LayerZero V2 bridge routes rely on Decentralised Verifier Networks (DVNs) to verify cross-chain messages. IMAA reads the on-chain ULN configuration for each OApp route, scores the DVN set for concentration risk, and surfaces a risk badge — no setup required.

Background

Each LayerZero V2 OApp has a send library configuration that specifies which DVNs must sign (required DVNs) and which are optional (with a quorum threshold). A 1-of-1 DVN route — where a single entity controls the only required signer — is the highest-risk configuration. The KelpDAO bridge exploit (April 2026) used exactly this pattern: one DVN, one point of failure.

Risk levels

Every route is scored into one level (first match wins). The score is about the DVN set itself; infrastructure concentration is a separate advisory (see below).

Level	Condition
Critical	1-of-1: a single required DVN with no optional threshold — it can unilaterally approve any message.
High	Every required DVN maps to the same operator. Multiple addresses, but one entity behind them — operationally still a single point of failure.
Medium	No redundancy: either every optional DVN must also verify (no tolerance for one failing), or there are multiple required DVNs with no optional relief — so any single required DVN going offline halts the route.
Low	Multi-operator set with the required threshold below the total DVN count — the route can tolerate a single DVN failing.

Infrastructure concentration

Separately from the DVN-set score, IMAA checks whether the required DVNs sit on shared infrastructure, using each DVN's known metadata:

If every required DVN shares the same RPC provider, that's flagged as a critical infrastructure warning.
If they share the same ASN (hosting network), that's a high infrastructure warning.

This warning appears as a separate line beneath the route — it does not change the route's own risk badge. Hosting region is displayed for context but is not used in scoring.

Where to see it

Contract detail page → Bridge Configuration tab: all routes for the contract, with a risk badge per route, the underlying DVN list, and any infrastructure warning.
Dashboard KPI card: the “Bridge Risk” count is the number of your monitored contracts that are LayerZero V2 OApps — a proxy for bridge exposure, not a count of routes at a particular risk level.
Public risk dashboard (no auth): imaa.w3i.io/public/dvn-risk — daily scan of well-known protocols.

No setup required

When you add a contract that implements a LayerZero V2 OApp interface, IMAA auto-detects the routes by reading the endpoint contract on-chain. The Bridge Configuration tab populates automatically. There is no DVN-specific configuration to complete.

Active alerts

The static risk score above is a read-only signal. The one DVN alerting target is bridge_dvn_change, which fires when a route's DVN configuration changes on-chain — a required DVN added or removed, the optional-DVN verification threshold lowered, or the route's overall risk level changing. Two config fields tune it:

severity_threshold (default any) — the minimum resulting risk level that triggers a fire. any alerts on every change; set it to high, for example, to only be paged when a change lands the route at High or worse.
alert_on_unknown_dvn (default true) — additionally fire when an unrecognised DVN operator appears in the set.

Use it as a first-line alert for any configuration drift on your bridge routes. The route data and static risk badges need no setup and no rule — they're there as soon as the contract is added. bridge_dvn_change is a standard alert rule: create it like any other, on whatever tier you're on, delivered to your configured channels and metered against your monthly alert quota.

Monitor targets — the bridge_dvn_change target type.
Alert rules — rule types and templates.