Chain 3961 · the record
What protects your funds, and what does not
Every claim on this page is checkable on-chain. Where a number appears, the command that produces it appears with it, so you never have to take this page's word for anything.
Figures load live from Ferminux, BNB Smart Chain and the bridge validators' own status report.
Bridge status right now
Reading the validators' status report…
The bridge app is offline while the proof bridge is in testing. The contracts below are live and hold funds; the status above is the validators' own report (/bridge/status.json), and it is the first thing to check before you rely on a transfer.
The invariant that matters most
The Ferminux bridge is lock-and-mint. Every wrapped FMX on BNB Smart Chain exists because real FMX is locked on Ferminux. If those two numbers ever diverge, wrapped tokens are circulating that nothing backs — which is how bridges fail. You can check them yourself right now.
checking…
cast call --rpc-url https://rpc.ferminux.net \ 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 \ "lockedBalance(address)(uint256)" 0x0000000000000000000000000000000000000000 cast call --rpc-url https://bsc-dataseed.bnbchain.org \ 0x73e64635E2a7b393F2aa3924dcf91fE3cFF51BD0 "totalSupply()(uint256)"
What actually protects the bridge
| Control | What it does | Setting |
|---|---|---|
| Validator quorum | Nothing is released or minted without signatures from a majority of the registered validators, each verifying against its own node. As of 24 September 2026 two of the three registered validator services are running, so the quorum has no spare: if one more stops, transfers stop. | — |
| Per-transfer cap | The largest single transfer the contract will accept, in either direction. | — |
| Rolling 24-hour cap | Total volume permitted per direction in any 24 hours. This is the ceiling on what any failure — including a compromised quorum — could remove before a human intervenes. | — |
| Governance timelock | Every privileged change — adding a validator, raising a cap, changing the wrapper — is announced on-chain and cannot take effect until the delay elapses. That window is the time anyone watching has to react. | — |
| Emergency pause | Halts every transfer immediately, with no delay and no quorum required. The pause key is held separately from the validator keys, so one does not imply the other. | — |
| Reconciliation | A process that reads both chains and matches every mint against its lock; a mint with no lock behind it is the signature of a forged quorum. It is not running while the bridge is offline, so until it is restarted the collateral check above is the check — and you can run it yourself. | offline |
| Bytecode pinning | The bridge only accepts a wrapper whose exact runtime code matches a pinned hash, which rejects proxies and any contract that could change behaviour later. | enforced |
What we do not claim
A security page that lists only strengths is not telling you the truth. These are the real limits as they stand today. They are stated here because you would find them anyway, and because knowing them is what lets you size your own risk.
This is a validator-secured bridge, not a trustless one.
- A compromised quorum could mint tokens that nothing backs. Two of the three validators, acting together, could sign a transfer that never happened. The caps above are what bound the damage, and the collateral check is what would surface it — neither prevents it.
- All registered validators are operated by one party. Each runs on its own machine, so no single compromised host yields a quorum. But they answer to the same operator, which buys machine independence, not independence of interest. Distributing custody to unrelated parties is the next step, and it has not been taken.
- Ferminux history is secured by signer keys, not by work. Blocks are confirmed by a set of authorised signers in rotation (Clique proof-of-authority, since block 160,000). They are not bonded: no stake stands behind them, and all are run by one operator. A majority of them signing a competing branch could rewrite recent history at no cost. The bridge waits 64 blocks before acting on a Ferminux transfer, every node refuses a reorganisation deeper than 64 blocks by default, and the 24-hour cap bounds what a signer majority could take by rewriting transfers it has already credited. How many signers are confirming right now: Consensus.
- The contracts have not been reviewed by an external audit firm. They have been through repeated adversarial review, including a preflight audit that caught a hundred-fold cap error before it became permanent, and the full source is published. That is not the same as an independent professional audit, and it should not be read as one.
- A bridge transfer cannot be reversed. No operator, including us, can recall or refund a delivered transfer. Send only to an address you control on the destination chain.
Foundation commitment
The foundation holds most of the supply, so "we are not selling" is worth nothing unless it can be checked. These coins sit in a contract that cannot release them before the date shown, and after it only to the multisig. It is a credibility instrument — it is not staking and it does not secure the chain.
Contract 0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d
cast call --rpc-url https://rpc.ferminux.net \ 0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d "locked()(uint256)" cast call --rpc-url https://rpc.ferminux.net \ 0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d "unlockAt()(uint64)"
Verify any of this yourself
None of the following requires trusting us. Every address is public and every value is readable by anyone.
| Contract | Chain | Address |
|---|---|---|
| Bridge | Ferminux | 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 |
| Bridge | BNB Smart Chain | 0xe43951a0E421A6B3Cb9C6ae66273dc0D3c8a70ff |
| Wrapped FMX | BNB Smart Chain | 0x73e64635E2a7b393F2aa3924dcf91fE3cFF51BD0 |
| Owner multisig | Ferminux | 0x910BD467D8576277f8f96DF47428377FFD94fEfe |
| Owner multisig | BNB Smart Chain | 0x15D0791d49A089863243BE2C2050e5d26E1bBA9c |
Confirm the validator set and quorum
cast call --rpc-url https://rpc.ferminux.net \ 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "getValidators()(address[])" cast call --rpc-url https://rpc.ferminux.net \ 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "threshold()(uint256)"
See whether anything is queued against the bridge right now
Every privileged change appears here before it can take effect. If you are holding wrapped FMX, this is the one thing worth checking periodically — a queued change you did not expect is your warning, and you have the full timelock window to act on it.
cast call --rpc-url https://rpc.ferminux.net \ 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "actionCount()(uint256)" # then, for each id, the pending action and when it becomes executable cast call --rpc-url https://rpc.ferminux.net \ 0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 \ "getAction(uint256)(bytes,uint64,bool,bool)" 0
If something looks wrong
Stop using the bridge and tell us: email security@ferminux.com, and put "live funds" in the subject if funds are at risk. A pause costs us very little and costs you nothing; a delayed pause is how bridge losses become large. Reports of a suspected flaw are welcome whether or not you are certain, and we would rather investigate ten false alarms than miss one. Do not describe an unfixed flaw in a public forum thread or bounty. The same contact is published at /.well-known/security.txt.
This page describes the system as deployed. Where it and the contracts disagree, the contracts are authoritative.