TxFlow, dubbed the “Pinduoduo version of Hyperliquid,” has about $39.29 million in USDC locked in its Arbitrum bridge, and only four validator keys can authorize withdrawals.
I checked the on-chain contracts: more than 2/3 of the signatures are enough to initiate a withdrawal. After that, there’s only a 200-second dispute window. If nobody hits pause during that time, the withdrawal goes through. An audit of @TxFlow_L1 by @OpenZeppelin also states that signatures from more than 2/3 of the hot wallets “can propose arbitrary withdrawals.”
To be fair, Hyperliquid’s own bridge also has four validators and a 200-second dispute window. The difference is the chain behind the bridge: Hyperliquid has 27 active validators, and anyone can run a node to verify things. Critics claim TxFlow has only five validators, all operated by the team, and relies on a single key for price feeds.
A team member responded this afternoon, explaining only that the bridge and API were inspired by Hyperliquid and that the matching engine was built in-house. They said nothing about validators or the oracle.
For those farming points on TxFlow, whether the USDC they deposit can be protected from abnormal withdrawals all comes down to whether anyone hits pause during those 200 seconds.
I checked the on-chain contracts: more than 2/3 of the signatures are enough to initiate a withdrawal. After that, there’s only a 200-second dispute window. If nobody hits pause during that time, the withdrawal goes through. An audit of @TxFlow_L1 by @OpenZeppelin also states that signatures from more than 2/3 of the hot wallets “can propose arbitrary withdrawals.”
To be fair, Hyperliquid’s own bridge also has four validators and a 200-second dispute window. The difference is the chain behind the bridge: Hyperliquid has 27 active validators, and anyone can run a node to verify things. Critics claim TxFlow has only five validators, all operated by the team, and relies on a single key for price feeds.
A team member responded this afternoon, explaining only that the bridge and API were inspired by Hyperliquid and that the matching engine was built in-house. They said nothing about validators or the oracle.
For those farming points on TxFlow, whether the USDC they deposit can be protected from abnormal withdrawals all comes down to whether anyone hits pause during those 200 seconds.
