The claim
“The PulseChain bridge is a centralised honeypot.”
A recurring claim; no single original source is attributed here.
What the code shows
Messages need 5 of 8 validator signatures (ForeignAMB.sol:106-139), but several single keys sit above that: the mediator owner can point the mediator at a different message bridge or counterpart (ForeignOmnibridge.sol:946-956), raise limits and enable an interest module that moves locked tokens to a contract it chooses (:2768-2775, :2813-2823); the upgradeabilityOwner can replace the code; the validator-contract owner can change the validator set. All of these are visible in the verified source; on 2026-10-17 their settings were the expected, harmless ones. Open the Ethereum-side mediator.
What exactly is claimed?
That the official bridge between Ethereum and PulseChain concentrates a large amount of locked funds under the control of a few keys, so that whoever controls or steals those keys could take them. The concern became common after the large bridge hacks of 2022 (Ronin, Wormhole, Nomad). It is a fair question for any bridge, and the answer is in the contracts and their on-chain settings.
How does the bridge normally decide what to release?
It is the OmniBridge + Arbitrary Message Bridge (AMB) design written by POA Network / Gnosis and deployed for PulseChain with its own validators. Tokens are locked on one side and minted on the other; a transfer back burns the bridged token and releases the original.
- A message is executed only when enough distinct current validators have signed it (
ForeignAMB.sol:106-139; PulseChain sideHomeAMB.sol:1513-1535). - On 2026-10-17: 8 validators, 5 signatures required, on both chains; both sides wait 65 block confirmations.
- Daily per-token limits cap how much can leave per day (
ForeignOmnibridge.sol:1211-1380).
The validators are not the only gate. The mediator accepts a message from whichever contract is set as its bridgeContract and whichever address is set as its counterpart on the other chain (ForeignOmnibridge.sol:936-940) — and both settings belong to the owner.
Who can change the bridge, and with which key?
| Power | Who holds it on 2026-10-17 | Code |
|---|---|---|
| Sign cross-chain messages | 8 validators, 5 needed, both chains | ForeignAMB.sol:106-139 |
| Add or remove validators, change the number of signatures needed | owner of the validator contract — single key: Ethereum 0x3ea02ef8a3956f69d23b5b30327e0f5e352e513f, PulseChain 0x6abe2f53bf2a6abaae791055ee0238dc919f4165 |
addValidator, removeValidator, setRequiredSignatures in the validator contracts (Ethereum, PulseChain) |
| Point the mediator at a different message bridge or a different counterpart mediator | mediator owner — single key: Ethereum 0x610094ab29d1bf683719d2ce3495d8635a47bfc6, PulseChain 0x4792865c793a2db4debdb30fcb8e38c45b09e7df |
ForeignOmnibridge.sol:946-956 |
| Change daily limits, per-transaction limits and fees | mediator owner |
:1336, :1349, :1374 |
Enable an “interest” module for a token; afterwards anyone can call invest(), which sends the locked balance above a threshold to the module the owner chose |
mediator owner (Ethereum side) |
:2768-2775, :2813-2823 |
| Replace the contract logic (upgrade the proxy) | upgradeabilityOwner of each proxy — single keys on both chains |
EternalStorageProxy.sol:395-431 |
Recovery: claim coins and unregistered tokens sent by mistake (every token that has ever been bridged is excluded); send tokens that reached the mediator without the bridge to a receiver it chooses (fixMediatorBalance); withdraw tokens stuck in a bridged-token contract |
upgradeabilityOwner |
:2398-2444 |
“Single key” means the address has no contract code — no on-chain multisig and no timelock. Whether those keys are protected off-chain (hardware, multi-party computation) cannot be seen from the chain. The same owner keys also control the separate mediators that move PLS itself.
What did the settings show on 2026-10-17?
Read with eth_call at Ethereum block 26,212,717 and PulseChain block 27,821,034:
These are the expected values: today the powers above are not in use. They are settings, though, and each can be changed in one transaction by the key that owns it.
Is there a hidden way to drain deposits?
Hidden, no — every power in the table is in the verified source. A way that bypasses the validators, yes: the mediator owner can repoint the mediator to a contract of its choice and release locked tokens or mint bridged tokens, or enable an interest module that receives the locked balance; the upgrade owner can replace the logic; the validator-contract owner can replace the validators. The risk is therefore the owner and upgrade keys, both single-key, plus the key that manages the validator set — not only the validators. Nothing in the code says how these keys are held or who holds them.
Was the bridge audited?
The upstream code family was: ChainSecurity audited OmniBridge (2021-04-27) and OmniBridge v6.0 (2021-09-07: 0 critical, 1 high partially corrected, 3 medium, 13 low), and Quantstamp assessed TokenBridge 5.4.1 including the message layer (2020-11-06: no high or medium issues). No audit of the PulseChain deployment itself has been found, and which upstream release it corresponds to has not been established.
What does it cost?
On-chain on 2026-10-17: 0.30 % for transfers from PulseChain to Ethereum, 0 % from Ethereum to PulseChain, plus gas on each chain. Fees are mutable settings of the fee manager.
Verdict
Partly accurate — as a description of risk. The code conceals nothing, and on 2026-10-17 every setting was the expected one. But the funds locked in the bridge depend not only on 5 of 8 validators: single keys can redirect the mediator, move locked balances through the interest module, replace the code or replace the validators. The code cannot show anyone’s intentions; it shows how much trust the bridge requires. Practical rule: bridged assets are only as safe as those keys, so move across only what you need. How it works in detail: PulseChain bridge.