What protects your funds, and what does not

Every claim on this page is checkable on-chain. Where a number appears, the command that produces it appears with it, so you never have to take this page's word for anything.

Figures load live from the Ferminux and BSC networks.

The invariant that matters most

The Ferminux bridge is lock-and-mint. Every wrapped FMX on BNB Smart Chain exists because real FMX is locked on Ferminux. If those two numbers ever diverge, wrapped tokens are circulating that nothing backs — which is how bridges fail. They are checked continuously, and you can check them yourself right now.

Collateral check

FMX locked on Ferminux

—

wFMX outstanding on BSC

—

checking…

cast call --rpc-url https://rpc.ferminux.net \
  0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 \
  "lockedBalance(address)(uint256)" 0x0000000000000000000000000000000000000000

cast call --rpc-url https://bsc-dataseed.bnbchain.org \
  0x73e64635E2a7b393F2aa3924dcf91fE3cFF51BD0 "totalSupply()(uint256)"

What actually protects the bridge

Control	What it does	Setting
Validator quorum	Nothing is released or minted without signatures from a majority of independent validators, each running on a separate machine and verifying against its own node.	2 of 3
Per-transfer cap	The largest single transfer the contract will accept, in either direction.	—
Rolling 24-hour cap	Total volume permitted per direction in any 24 hours. This is the ceiling on what any failure — including a compromised quorum — could remove before a human intervenes.	—
Governance timelock	Every privileged change — adding a validator, raising a cap, changing the wrapper — is announced on-chain and cannot take effect until the delay elapses. That window is the time anyone watching has to react.	—
Emergency pause	Halts every transfer immediately, with no delay and no quorum required. The pause key is held separately from the validator keys, so one does not imply the other.	instant
Continuous reconciliation	An independent process reads both chains and matches every mint against its corresponding lock. A mint with no lock behind it is the signature of a forged quorum, and it raises an alarm rather than waiting for a user to notice.	24/7
Bytecode pinning	The bridge will only accept a wrapper whose exact runtime code matches a pinned hash, which rejects proxies and any contract that could change behaviour later.	enforced

What we do not claim

A security page that lists only strengths is not telling you the truth. These are the real limits as they stand today. They are stated here because you would find them anyway, and because knowing them is what lets you size your own risk.

This is a validator-secured bridge, not a trustless one

A compromised quorum could mint tokens that nothing backs. Two of the three validators, acting together, could sign a transfer that never happened. The caps above are what bound the damage, and the reconciliation above is what would surface it — neither prevents it.
All three validators are currently operated by one party. They run on three separate machines, so no single compromised host yields a quorum. But they answer to the same operator, which means this buys machine independence, not independence of interest. Distributing custody to unrelated parties is the next step, and it has not been taken.
Ferminux is a young proof-of-work chain with modest hashrate. Deep reorganisations are more affordable here than on an established network. The bridge waits 64 blocks before acting on a Ferminux transfer for exactly this reason, and the 24-hour cap is set against the cost of renting enough hashrate to rewrite that many blocks.
The contracts have not been reviewed by an external audit firm. They have been through repeated adversarial review, including a preflight audit that caught a hundred-fold cap error before it became permanent, and the full source is published. That is not the same as an independent professional audit, and it should not be read as one.
A bridge transfer cannot be reversed. No operator, including us, can recall or refund a delivered transfer. Send only to an address you control on the destination chain.

Foundation commitment

The foundation holds most of the supply, so "we are not selling" is worth nothing unless it can be checked. These coins sit in a contract that cannot release them before the date shown, and after it only to the multisig. It is a credibility instrument — it is not staking and it does not secure the chain.

Foundation lock-up

FMX locked

—

Releasable from

—

Contract

0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d

cast call --rpc-url https://rpc.ferminux.net \
  0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d "locked()(uint256)"
cast call --rpc-url https://rpc.ferminux.net \
  0xC0E01D9F49eE0967F34e1CB045B74D3Aefac189d "unlockAt()(uint64)"

Verify any of this yourself

None of the following requires trusting us. Every address is public and every value is readable by anyone.

Contract	Chain	Address
Bridge	Ferminux	0xe162eeDa683f067d4Ebf61060Fa322332a779EF4
Bridge	BNB Smart Chain	0xe43951a0E421A6B3Cb9C6ae66273dc0D3c8a70ff
Wrapped FMX	BNB Smart Chain	0x73e64635E2a7b393F2aa3924dcf91fE3cFF51BD0
Owner multisig	Ferminux	0x910BD467D8576277f8f96DF47428377FFD94fEfe
Owner multisig	BNB Smart Chain	0x15D0791d49A089863243BE2C2050e5d26E1bBA9c

Confirm the validator set and quorum

cast call --rpc-url https://rpc.ferminux.net \
  0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "getValidators()(address[])"

cast call --rpc-url https://rpc.ferminux.net \
  0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "threshold()(uint256)"

See whether anything is queued against the bridge right now

Every privileged change appears here before it can take effect. If you are holding wrapped FMX, this is the one thing worth checking periodically — a queued change you did not expect is your warning, and you have the full timelock window to act on it.

cast call --rpc-url https://rpc.ferminux.net \
  0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 "actionCount()(uint256)"

# then, for each id, the pending action and when it becomes executable
cast call --rpc-url https://rpc.ferminux.net \
  0xe162eeDa683f067d4Ebf61060Fa322332a779EF4 \
  "getAction(uint256)(bytes,uint64,bool,bool)" 0

If something looks wrong

Stop using the bridge and tell us. A pause costs us very little and costs you nothing; a delayed pause is how bridge losses become large. Reports of a suspected flaw are welcome whether or not you are certain, and we would rather investigate ten false alarms than miss one.