Skip to content
Fuga Labs
Scope an engagement
Sector preset

Rollups

For teams who operate a chain of their own, where the worst day is the one on which nothing happens at all.

Scope an engagement Every sector preset
PresetonboardRollupDetectors in play16Boundaries declared3Refusals at onboarding1

How this sector loses money.

A rollup is rarely taken through its own execution. It is taken through the L1 contract that holds every asset bridged into it, by the key that can replace that contract's implementation. Or it is not taken at all: the sequencer stops, and nobody can leave except through forced inclusion.

Answered by
  • 12Deterministic rules
  • 2Invariants
  • 1Coverage
  • 1Models

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardRollup(platform, config) 7 configured
  1. 01Sequencer liveness on your chain, alerting at six times the block interval you declare
  2. 02Atomic value conservation over the L1 escrow, at zero fee and zero dust tolerance
  3. 03A withdrawal ceiling per token per window, netted across the whole escrow set
  4. 04The full upgrade surface on both chains: admin changes, EOA role grants, implementation diffs, uninitialised proxies, critical selectors
  5. 05Timelock hygiene in front of an upgrade: shortened delays, queued critical actions, and bypass
  6. 06Pre-inclusion screening attached report-only, with a never-exclude list covering your own system contracts
  7. 07Measured block contiguity on the chain itself, so a stall is told apart from a gap in our own view
Detectors in play
  • rules.l2-sequencer-anomaly
  • ops.ingest-coverage-gap
  • inv.atomic-value-conservation
  • invariants.event
  • rules.admin-authority-change
  • rules.role-granted-to-eoa
  • rules.authority-handover-fresh-account
  • rules.upgrade-implementation-diff
  • rules.uninitialized-proxy
  • rules.critical-selector
  • rules.timelock-critical-action-queued
  • rules.timelock-delay-reduced
  • rules.timelock-bypass
  • rules.proportional-drain
  • rules.multi-token-sweep
  • ml.fundflow-anomaly

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge A proof system is not something an execution-layer monitor verifies.
Closed by Closed by measuring the money rather than the mathematics. A fraudulent output root that survives the challenge window still has to move value out of escrow, and conservation plus the per-window withdrawal ceiling both fire on the arithmetic, whether or not the proof was valid.
The edge A sequencer outage and an outage of our own view of your chain look identical from the inside.
Closed by Closed by reporting coverage instead of assuming it. Contiguity is measured on the chain itself, the stall rule is marked non-deterministic so it can never gate on its own, and the alert says which possibility it can actually vouch for.
The edge Nothing can screen a transaction your sequencer never sees.
Closed by Closed by putting the screen where the decision already lives. It runs inside your block builder, synchronous and allocation-light, against an immutable versioned snapshot, so two replicas building the same block reach the same answer and a replay can be checked against the version that produced it.
Pre-inclusion screening is refused in enforcing mode at onboarding. It attaches report-only, and arming it is a separate act you take later.

Exclusion is censorship, and censorship-resistance is a property your chain gets judged on. A screener armed on day one decides against a label set nobody has watched in shadow, so the first thing it declines is as likely to be legitimate as hostile. Report-only first, then the shadow period, then you arm it.

A default that is a refusalEnforced at onboarding, before anything is configured

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Your chain and its L1 escrow set, plus the block interval you declare, which is what the stall rule measures against. Your own system contracts go on the never-exclude list first.

  2. Step 2

    Detect

    Conservation over the escrow runs at zero fee and zero dust tolerance. Contiguity is measured on the chain itself, so a stall is told apart from a gap in our view and the stall rule never gates alone.

  3. Step 3

    Prevent

    Pre-inclusion screening attaches report-only and is refused in enforcing mode. Arming it is a separate act you take later, against an immutable versioned snapshot, so two replicas building one block reach one answer.

What runs underneath.

The staged path to arming the Circuit Breaker is the one that matters on a chain you operate, because a screener armed on day one loses the argument in public.

The base under all eleven presets

Scope Rollups coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset