How Does Celer Network Work?
A bridge that moves your tokens between 50+ blockchains by routing messages through a network of validators. It holds about $130M in its liquidity pools. Its C+ grade reflects the risk that if two-thirds of its validators are compromised or bribed, every dollar in the bridge can be stolen.
TVL
$22M
Sector
Bridge
Risk Grade
C+
Value Grade
B-
Core Mechanisms
Bridge/Message-Passing
SGN: State Guardian Network using Tendermint BFT consensus to route cross-chain messages for cBridge and Celer IM
SGN is a PoS blockchain built on Tendermint, staking CELR tokens for economic security. Validators reach BFT consensus on cross-chain message validity. Standard Tendermint model but applied to cross-chain messaging, inheriting 2/3 compromise threshold risk.
Bridge/Liquidity-Pool
cBridge: pool-based asset bridge where liquidity providers deposit assets on each chain, enabling cross-chain transfers via SGN-routed messages
Standard liquidity pool model for bridges. LPs provide assets on source and destination chains; SGN validators approve transfer messages. LPs earn 50% of fees but face full loss exposure if SGN is compromised and approves fraudulent transfers.
Bridge/Inter-Chain-Messaging
Celer IM: generalized message passing framework enabling arbitrary cross-chain data and function calls via SGN routing
Celer IM extends cBridge's message routing to arbitrary data and smart contract calls. Enables cross-chain dApps but expands attack surface: any dApp using Celer IM inherits SGN's security assumptions.
Bridge/Optimistic-Validation
NovelOptimistic rollup protection: optional delay buffer for critical messages with independent watchtower validation before execution
Celer IM allows dApps to inject a delay buffer for high-risk operations and run independent watchtowers to validate SGN messages. If inconsistency is detected, message is blocked. Novel defense-in-depth approach but requires dApps to operate their own infrastructure, which may fail or be compromised.
5.1.1
CELR token: staking asset for SGN validators and governance token for protocol parameters
Standard dual-purpose token: staked for validator participation (economic security) and used for governance (fee structures, supported chains, parameter changes). Validators face slashing if they misbehave, but slashing may not cover stolen assets if economic attack is profitable.
Fee-Split
50/50 fee split: cBridge fees divided equally between SGN validators/stakers and liquidity providers
Aligns incentives between security providers (SGN validators) and liquidity providers. Standard revenue sharing model. If fees are insufficient, validators may be economically rational to attack the bridge rather than protect it.
Bridge/Multi-Chain
Novel50+ chain support: cBridge and Celer IM support 40+ blockchains and L2 rollups, aggregating cross-chain liquidity
Celer's broad chain coverage is operationally novel, requiring SGN to maintain light clients or RPC connections to 50+ chains. This increases operational complexity and attack surface (any chain-specific RPC exploit could feed malicious data to SGN).
How the Pieces Interact
If total staked CELR value is less than cBridge TVL or potential profit from manipulating high-value dApps, validators can profitably collude to attack the bridge. BFT consensus only works if honest behavior is economically dominant.
LPs deposit assets trusting SGN to only approve legitimate transfers. If SGN is compromised, validators can forge transfer approvals, draining LP assets. LPs have no recourse; their funds are custodied by SGN consensus.
Optimistic security only works if watchtowers are online, correctly implemented, and not compromised. If watchtower fails, malicious SGN messages execute without detection, bypassing the defense layer entirely.
SGN must maintain connectivity and state validation for 50+ chains. Compromised RPC endpoints or light client bugs on any chain could feed malicious data to SGN, causing validators to approve fraudulent cross-chain messages.
Celer IM enables arbitrary cross-chain function calls. If a dApp's cross-chain message handler has vulnerabilities (reentrancy, access control flaws), attackers can exploit it via Celer IM, even if SGN operates honestly.
What Could Go Wrong
- SGN (State Guardian Network) uses Tendermint PoS with CELR staking, but economic security depends on whether staked CELR value exceeds potential profit from attacking the bridge; if not, validators can profitably collude to drain liquidity pools
- cBridge and Celer IM route all cross-chain messages through SGN validators; if 2/3+ of validators are compromised (economic attack, regulatory coercion, or coordinated exploit), entire multi-chain ecosystem is vulnerable to message forgery
- Optimistic rollup protection (delay buffer + watchtower) is opt-in and requires dApps to run independent infrastructure; if watchtowers fail or are compromised, the optimistic security layer provides no protection
SGN Validator Collusion and Cross-Chain Message Manipulation
ModerateTrigger: Sufficient SGN (State Guardian Network) validators collude to forge or censor cross-chain messages, exploiting the 2/3 BFT threshold to drain cBridge liquidity pools or manipulate inter-chain dApp state
- 1.Attackers compromise or coordinate 2/3+ of CELR-staked validators in the SGN through economic incentives, social engineering, or regulatory coercion — Colluding validators can forge cross-chain messages, approving fraudulent asset transfers or manipulating dApp states across connected chains
- 2.Forged messages drain cBridge liquidity pools on target chains; liquidity providers suffer losses as assets are stolen via fake cross-chain transfer approvals — cBridge TVL ($130M) drops precipitously as LPs withdraw remaining funds; cross-chain transfers halt as remaining liquidity is insufficient
- 3.Inter-chain dApps relying on Celer IM (Inter-chain Messaging) face state corruption or fund theft as malicious messages execute — Ecosystem-wide crisis: all dApps using Celer IM must halt operations, freeze funds, or accept corrupted state; reputation damage is catastrophic
- 4.CELR token crashes as staked validators face slashing, but slashing penalties are insufficient to cover stolen assets; SGN economic security is revealed as inadequate — Celer Network ceases to function as a trusted cross-chain infrastructure; users migrate to alternative bridges (Axelar, LayerZero); protocol is abandoned
Risk Profile at a Glance
Overall: C+ (40/100)
Lower score = safer