Cross-Chain Bridge Risk Assessment: Gauntlet

The Gauntlet cross-chain bridge, which moved $1.63B worth of assets between Ethereum and Layer-2 networks as of September 2026, is deemed to have significant risk according to a security assessment. The bridge's smart contracts contain three high-severity vulnerabilities: re‑entrancy in the withdraw function, unchecked external calls, and integer overflow in fee calculations.

The relayer/validator design also suffers from two high-severity issues: insufficient finality quorum and no slashing for validator equivocation, both of which could enable collusion attacks.

The bridge's price oracle and fee mechanism are rated medium severity due to a single-source price feed that could be manipulated, and lack of fallback to median feeds. Governance and upgrade mechanisms are rated medium severity because a single "TimelockAdmin" address can upgrade the bridge without multi-sig verification, and there are no bounds checks on certain parameters.

Finally, there is a low-severity liquidity issue: the bridge holds no automated liquidity backstop when reserves fall below 5% of total value locked, leaving users exposed to liquidity exhaustion attacks. Overall, the assessment gave the Gauntlet bridge a risk score of 7.4 out of 10, indicating moderate-to-high systemic risk.