XVS Bridge: Close opBNB / Optimism / Unichain / zkSync, Tighten Ethereum

VIP-615 retired the Venus Core Pool on opBNB, Optimism, and Unichain, but the XVS bridge between BSC and those chains stayed open at the same capacity it had during normal operation. This proposal closes that gap. zkSync receives the same outbound closure for a separate reason: Venus no longer maintains an XVS price oracle on that chain, so the USD-denominated cap on outbound transfers can no longer be validated against a current feed. For all four chains a small inbound capacity is preserved so any remaining holders can return their XVS to BSC. Ethereum β€” the only route that stays open in both directions β€” is tightened to match current usage; Arbitrum and Base are unchanged.

Background

When the Core Pool on a chain is wound down, the bridge to that chain stops serving any product purpose β€” no Venus market remains on the destination side to consume or produce XVS. The outbound caps, however, were never reset: Optimism and Unichain each still allowed up to $20,000 in a single transfer and $100,000 per day, and opBNB still allowed $10,000 single / $50,000 daily. All of that capacity now represents exposure without corresponding utility, exploitable if any part of the bridge path were compromised. This proposal sets the outbound caps on these three chains to ****$0 in both the single-transaction and daily dimensions, fully disabling new BSC β†’ destination sends until a future VIP reactivates the route.

The same outbound closure applies to zkSync, but for a different reason. Redstone no longer maintains an XVS price oracle on zkSync, which means the USD-denominated cap on that route can no longer be validated against a current price feed. Rather than leave the route exposed without functioning price-based controls, the outbound caps on zkSync are zeroed as well (from $20,000 single / $100,000 daily) until oracle support is restored.

For all four chains β€” opBNB, Optimism, Unichain, and zkSync β€” the inbound side is preserved at a small non-zero level. Holders who still hold XVS on those chains, whether sitting in wallets or stuck mid-flight, need a way to bring those tokens back to BSC. A small inbound cap preserves that exit path without re-opening meaningful outbound capacity.

Ethereum is the only route that remains open in both directions; the change there is a right-sizing, not a closure. The route’s caps were last set in VIP-407 and have not been revisited since, and actual usage has run far below those levels for an extended period. The outbound single-transfer cap is reduced from $100,000 to $30,000 and the outbound daily cap from $1,000,000 to $150,000; the inbound single-transfer cap from $102,000 to $20,000 and the inbound daily cap from $1,020,000 to $50,000. The new limits leave normal user flow unaffected while cutting worst-case single-transfer exposure by roughly 70%. Arbitrum and Base remain at their current limits and are not part of this adjustment.

Details

Each cap stored on the BSC contract XVSProxyOFTSrc (0xf8F46791E3dB29a029Ec6c9d946226f3c613e854) is denominated in USD with 18 decimals. When a transfer is initiated, the contract converts the requested XVS amount to USD via the Venus ResilientOracle and compares the result against the configured cap. Transfers that exceed the single-transaction cap revert immediately; transfers that fit individually but would push the rolling 24-hour total above the daily cap revert as well.

From the perspective of BSC, send limits apply to BSC β†’ destination transfers and receive limits apply to destination β†’ BSC transfers. Each direction has both a single-transaction cap and a daily cap.

Action

This proposal consists of 20 setter calls on the BSC XVSBridgeAdmin (0x70d644877b7b73800E9073BCFCE981eAaB6Dbc21). For each of the five affected destinations (Ethereum, opBNB, zkSync, Optimism, Unichain), four caps are updated:

  • setMaxSingleTransactionLimit(uint16,uint256) β€” outbound single-transfer cap
  • setMaxDailyLimit(uint16,uint256) β€” outbound daily cap
  • setMaxSingleReceiveTransactionLimit(uint16,uint256) β€” inbound single-transfer cap
  • setMaxDailyReceiveLimit(uint16,uint256) β€” inbound daily cap
Destination (LzChainId) Daily Send Single Send Daily Receive Single Receive
Ethereum (101) $1,000,000 β†’ $150,000 $100,000 β†’ $30,000 $1,020,000 β†’ $50,000 $102,000 β†’ $20,000
opBNB (202) $50,000 β†’ $0 $10,000 β†’ $0 $51,000 β†’ $1,000 $10,200 β†’ $1,000
Arbitrum (110) unchanged unchanged unchanged unchanged
zkSync (165) $100,000 β†’ $0 $20,000 β†’ $0 $102,000 β†’ $10,000 $20,400 β†’ $10,000
Optimism (111) $100,000 β†’ $0 $20,000 β†’ $0 $102,000 β†’ $2,000 $20,400 β†’ $2,000
Base (184) unchanged unchanged unchanged unchanged
Unichain (320) $100,000 β†’ $0 $20,000 β†’ $0 $102,000 β†’ $10,000 $20,400 β†’ $10,000

A concrete example: at an XVS price of $6, the new Ethereum single-transaction send cap of $30,000 means any outbound transfer larger than ~5,000 XVS would be rejected with Single Transaction Limit Exceed. Daily totals work the same way against the 24-hour rolling sum.

Summary

If approved, this proposal will:

  • Close outbound XVS bridging from BSC to opBNB, Optimism, and Unichain (consistent with the VIP-615 Core Pool sunset) and to zkSync (no XVS oracle on that chain) by zeroing their send caps
  • Preserve a small inbound capacity from all four chains so existing holders can return their XVS to BSC
  • Tighten Ethereum caps in both directions to match current usage; leave Arbitrum and Base unchanged

We welcome community feedback on this proposal ahead of submitting it for a VIP vote.

2 Likes

Allez Labs supports this proposal. Closing low-utility rate limits and tightening Ethereum to match flow is aligned with our cross-chain risk assessment. The historical data below makes the case piece by piece.

XVS is mostly a BSC-native asset

BSC holds 99.4% of XVS. The four chains the proposal closes outbound on hold a minimal share of total supply, and two of them (opBNB, Optimism) saw fewer than 10 bridge events in the entire last 6 months. Closing their outbound preserves all observed legitimate flow.

Chain Supply (USD) Outbound velocity (180d daily p99, aggregate across destinations, USD)
BSC (hub) ~$82M ~$5K
Ethereum ~$335K 77 active days, ~$85K
zkSync ~$75K 51 active days, ~$22K
Arbitrum ~$63K 63 active days, ~$20K
Unichain ~$39K 87 active days, ~$10K
Optimism ~$3K 4 events / 180d, ~$3K
Base ~$70 2 events / 180d, ~$10
opBNB ~$100 3 events / 180d**,** ~$0

Combined supply on opBNB + Optimism + Unichain is ~$42K, or 0.05% of total. zkSync adds another ~$75K, on a chain whose Redstone XVS price feed has been deprecated. The proposal closes outbound on chains whose realized flow has either dwindled to a handful of events or whose price oracle has gone offline.

The proposed daily caps are sized correctly against realized flow

The proposal updates four cap types (single + daily, outbound + inbound) across five destinations on the BSC XVSBridgeAdmin. Each proposed daily outbound cap is well above the realized p99 on that route over the last 180 days (or zero on the four closed chains, where outbound p99 is already negligible):

Destination Proposed daily outbound Proposed daily inbound Prior daily caps Realized daily volume (p99, 180d)
Ethereum $1,000,000 β†’ $150,000 $1,020,000 β†’ $50,000 $1M / $1.02M Ethereum->BSC ~$85K; BSC->Ethereum ~$6K
zkSync $100,000 β†’ 0 (closed) $102,000 β†’ $10,000 $100K / $102K zkSync->BSC ~$22K; BSC->zkSync ~$4K
Unichain $100,000 β†’ 0 (closed) $102,000 β†’ $10,000 $100K / $102K Unichain->BSC ~$10K; BSC->Unichain ~$3K
Optimism $100,000 β†’ 0 (closed) $102,000 β†’ $2,000 $100K / $102K Optimism->BSC ~$3K (4 events / 180d)
opBNB $50,000 β†’ 0 (closed) $51,000 β†’ $1,000 $50K / $51K ~$0 (3 events / 180d on either side)

The retained inbound floors ($10K/day for zkSync and Unichain, $2K for Optimism, $1K for opBNB) preserve an exit path for the ~$117K still stranded on those chains (zkSync + the three deprecated chains) without re-opening meaningful outbound risk. The single-transfer caps on the same routes are zeroed in lock-step with the daily caps; on Ethereum they tighten in proportion (outbound $100K β†’ $30K, inbound $102K β†’ $20K), cutting worst-case one-shot exposure by 70-80% depending on direction.

The asymmetric Ethereum cap shape is risk-weighted, not flow-matched

The proposed Ethereum split (outbound $150K/day, inbound $50K/day) places the tighter cap on the higher-flow inbound direction:

  • Ethereum -> BSC (high-flow): ~$85K daily p99, ~$133K daily max over 180d. Capped at $50K/day.
  • BSC -> Ethereum (low-flow): ~$6K daily p99, ~$9K daily max - about 14x lower. Capped at $150K/day.

This is the opposite of flow-matched sizing. The rationale is risk-driven: XVS is BSC-native and naturally flows from spokes back to its home chain, so the inbound side carries the bulk of realized exposure. The proposal constrains that direction below historical p99 to bound verifier-compromise damage, while leaving generous headroom on the rarely-used outbound side.

The tightening materially shrinks the worst-case bridge exposure

A LayerZero verifier compromise can reach every route that shares the same operator pair simultaneously. Summing the BSC<->spoke 24h caps (outbound + inbound):

  • Pre-Proposal: Ethereum $2.02M + Arbitrum $200K + Base $200K + zkSync $200K + Unichain $200K + Optimism $200K + opBNB $100K = ~$3.12M/24h.
  • Post-Proposal: Ethereum $200K ($150K + $50K) + Arbitrum $200K (unchanged) + Base $200K (unchanged) + zkSync $10K + Unichain $10K + Optimism $2K + opBNB $1K = ~$623K/24h.
  • Net: ~80% reduction in the dollar surface a single verifier compromise can touch in one window, even without touching the Arbitrum or Base routes.

Allez Labs supports moving the proposed rate-limit as drafted.

Methodology

A note on the p99 metric. Per-route flow is summarized by p99 daily volume over the observed 180 day window - the level only 1 in 100 days exceeded. p99 is the right reference for cap sizing: tighter than the absolute max (which is one anomalous day) and far above the median (which underestimates busy days). A cap set above p99 absorbs every observed day except a handful of outliers; a cap set below p99 would have clipped legitimate flow more than once a quarter.