Reconfigure BSC governance forwarding after Wormhole auto delivery shutdown

Proposals
1

Removal of the Wormhole adapter from a.DI governance forwarding to BNB Chain and threshold change from 3/4 to 2/3

Summary

This proposal suggests removing the Wormhole adapter from Lido DAO governance forwarding to BNB Chain and lowering the required confirmations on BNB Chain from 3 of 4 to 2 of 3 bridges.

Wormhole shut down automatic delivery for its Standard Relayer on 1 April 2026. The Lido Wormhole adapter depends on that relayer, so only Chainlink CCIP, LayerZero and Hyperlane can still deliver Lido DAO messages to BNB Chain. With three working bridges and a threshold of three, an outage or delay of any one of them blocks Lido DAO decisions on BNB Chain. A 2-of-3 threshold restores tolerance to one bridge outage; forging a message would then require compromising two bridges instead of three.

Background

Lido DAO decisions reach BNB Chain through a.DI, the cross-chain messaging layer built by BGD Labs and adopted for Lido under LIP-24. The Lido DAO Agent sends a message to the CrossChainController on Ethereum, which forwards it through four bridges. The CrossChainController on BNB Chain accepts the message once 3 of the 4 bridges have delivered it. The CrossChainExecutor then executes it.

Bridge Ethereum adapter BNB Chain adapter
Chainlink CCIP 0x29D4fA5FCC282ba2788A281860770c166F597d5d 0x15AD245133568c2498c7dA0cf2204A03b0e9b98A
Hyperlane 0x8d374DF3de08b971777Aa091fA68BCE109b3a7F3 0xCd867B440c726461e5fAbe8d3a050b2f8701C230
LayerZero 0x742650E0441Be8503682965d601AD0Ba1fB54411 0xc934433f4c433Cf80DE6fB65fd70C7a650D8a408
Wormhole 0xEDc0D2cb2289BBa1587424dd42bDD1ca7eAbDF17 0xBb1E43408BbF2C767Ff3Bd5bBC34E183CC1Ef119

LIP-24 set the threshold at 3 of 4. With four working bridges, this setting tolerates the failure of any one bridge, and forging a message requires compromising three.

The CrossChainExecutor is the owner of the wstETH token on BNB Chain and of the NTT Manager, Wormhole Transceiver and Axelar Transceiver of the wstETH bridge (addresses in deployed contracts). A message accepted on BNB Chain can therefore call any owner function of these contracts.

Issue

The Wormhole leg of the route no longer has a committed delivery to BNB Chain, so every Lido DAO message now depends on CCIP, LayerZero and Hyperlane all delivering it. If one of them fails, the message waits until that bridge recovers or someone redeems the Wormhole copy manually.

  • Wormhole shut down its Standard Relayer service on 1 April 2026. Wormhole Guardians still sign messages, so a message can still be redeemed manually, but Wormhole no longer delivers it to the destination chain. The replacement service, Executor, requires a different adapter.
  • The Lido Wormhole adapters on both chains have the Standard Relayer address (0x27428DD2d3DD32A4D7f7C497eAaa23130d894911) fixed at deployment and cannot use the Executor.
  • The Standard Relayer on Ethereum still accepts requests. Its delivery quote for BNB Chain has been 0 since block 24788662 (2 April 2026, 01:34 UTC) and was non-zero before.
  • A request that pays nothing gives no operator a reason to deliver it. Other applications’ Standard Relayer messages to BNB Chain are still delivered by their own or third-party relayers (Wormholescan); Lido has no such arrangement.
  • The Ethereum CrossChainController records the Wormhole attempt as successful, so the failure is not visible on Ethereum. A forwarding simulated on an Ethereum mainnet fork at block 26126408 confirmed this: all four adapters reported success.

The issue was reported in lidofinance/aave-delivery-infrastructure#12 on 3 September 2026.

Rationale

The route has to keep delivering Lido DAO messages and stay hard to forge. Since Wormhole stopped delivering, the 3-of-4 setting keeps its forgery margin but tolerates no bridge outage. We compared four options:

Option Bridge outages tolerated Bridges to compromise to forge a message Needs new code and audit Needs a manual step per message
Keep 3 of 4 0 3 No No
Keep 3 of 4 and redeem Wormhole messages manually 1, while Wormhole redemption tooling is available 3 No Yes
Replace the Wormhole adapter with an Executor-based one, keep 3 of 4 1 3 Yes No
Remove Wormhole, require 2 of 3 (proposed) 1 2 No No

We propose 2 of 3 because it is the only option that restores tolerance to one bridge outage with no new code and no manual step for each message. The cost is a lower forgery margin: two bridges instead of three. The CrossChainExecutor has no execution delay and no guardian, so an accepted message executes without a veto window under either threshold.

For the amount at stake today, we consider confirmation by two independent bridges sufficiently reliable. About 1,189 wstETH is bridged to BNB Chain (supply), backed by wstETH locked in the NTT Manager on Ethereum. That is about 1,481 stETH, or $4.0M at Chainlink prices on 5 October 2026.

If the bridged amount grows substantially, a separate proposal can add a fourth working adapter, such as an Executor-based Wormhole adapter or another bridge, and restore 3 of 4.

Proposal

Disable the Wormhole adapters on both chains and require 2 of the 3 remaining bridges to confirm a message.

Parameter Current Proposed
Bridges, Ethereum → BNB Chain CCIP, Hyperlane, LayerZero, Wormhole CCIP, Hyperlane, LayerZero
Required confirmations on BNB Chain 3 of 4 2 of 3

Proposed vote items:

  1. The Lido DAO Agent calls forwardMessage on the Ethereum CrossChainController (0x93559892D3C7F66DE4570132d68b69BD3c369A7C) with the BNB Chain CrossChainExecutor as destination and a gas limit of 1,200,000. The bridge delivery that completes the quorum also queues the action set on BNB Chain, which takes about 880,000 gas. The message carries one action set that calls the BNB Chain CrossChainController (0x40C4464fCa8caCd550C33B39d674fC257966022F):
    • disallowReceiverBridgeAdapters([(0xBb1E43408BbF2C767Ff3Bd5bBC34E183CC1Ef119, [1])]) stops accepting Wormhole deliveries from Ethereum;
    • updateConfirmations([(1, 2)]) sets the required confirmations for messages from Ethereum (chain ID 1) to 2.
  2. The Lido DAO Agent calls disableBridgeAdapters([(0xEDc0D2cb2289BBa1587424dd42bDD1ca7eAbDF17, [56])]) on the Ethereum CrossChainController, which stops forwarding to BNB Chain (chain ID 56) through Wormhole.

Item 1 runs before item 2, so the message carrying the BNB Chain change still goes out through all four bridges. Under the current setting it needs CCIP, LayerZero and Hyperlane to deliver it. If one of them fails, the Wormhole copy of the message can be redeemed manually as the third confirmation.

No fee top-up is needed. The Ethereum CrossChainController pays bridge fees from its own balance, 0.497 ETH and 5.01 LINK today, and a fork simulation of item 1 with this gas limit spent about 0.0007 ETH and 0.041 LINK.

Next steps

  1. If there are no objections, the vote items above will be included in an upcoming Lido DAO on-chain vote, executed through Dual Governance.
  2. Once the message reaches BNB Chain, contributors will call execute on the CrossChainExecutor within 24 hours of the message’s arrival; after that, the action set expires.
  3. The deployed contracts page will be updated to mark the Wormhole adapters as disabled.

Feedback welcome before moving to an on-chain vote!

References

3 Likes