# Butter Network Markdown version of https://ethbeat.org/interop/protocols/butternetwork ## Summary **Warning:** Critical contracts can be upgraded by an EOA which could result in the loss of all funds. **Warning:** The bridge is paused during a [routing infrastructure upgrade](https://x.com/ButterNetworkio/status/2110682522564825340). - Last 24h transfer count: 0 ### About Liquidity bridge and messaging protocol using the MAP relay chain (an alt-L1) and its light-client network to verify cross-chain messages. ### Links - Contracts explorer (Disco): https://disco.ethbeat.org/ui/p/butternetwork ## Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2026-10-16 09:52 UTC](https://ethbeat.org/interop/protocols/butternetwork?update=7172ce00) (high severity, 1 change) The Butter Bridge on Base is paused. The Safe at the same address paused the bridge on Ethereum, Arbitrum, Optimism, Polygon PoS and BSC within the same 2h. Linea and Avalanche have stayed paused since the May 2026 exploit. Outbound transfers and inbound message execution are halted. https://x.com/ButterNetworkio/status/2110682522564825340 . ### [2026-10-01 10:35 UTC](https://ethbeat.org/interop/protocols/butternetwork?update=c540e3bd) (high severity, 1 change) 7702 re-delegation of a multisig signer. ### [2026-08-05 07:34 UTC](https://ethbeat.org/interop/protocols/butternetwork?update=beb20722) (8 changes) Butter interop protocol init disco: validation checks BLS sigs of a validator set on an external L1 (MAP Protocol). Validators can update the set with the discovered quorum. Each bridge tx verifies a merkle proof agains validator-signed block headers from the external L1. The L1 is supposed to run light clients of all participating chains. ## Permissions Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/butternetwork ### Base Chain #### Actors ##### SafeL2 (0x9987…1999) Addresses: [0x9987463102993e177b107e0cE97a0420428D1999](https://basescan.org/address/0x9987463102993e177b107e0cE97a0420428D1999) A Multisig with 3/5 threshold. - Can interact with Butter AuthorityManager - change AuthorityManager permissions and execute restricted Bridge and FeeService management operations Participants (5): [0xe8D95c201c20d759ed9429195F20767684Ebdf62](https://basescan.org/address/0xe8D95c201c20d759ed9429195F20767684Ebdf62), [0xe875f05e42ccFAFA8B64CA6344687E5cC60005Be](https://basescan.org/address/0xe875f05e42ccFAFA8B64CA6344687E5cC60005Be), [0x378F2eC828DB2fD49D238c91e5A278cF30aBeb66](https://basescan.org/address/0x378F2eC828DB2fD49D238c91e5A278cF30aBeb66), [0xEc624b9A64Be03E2DBAc8B78613A45955C855A87](https://basescan.org/address/0xEc624b9A64Be03E2DBAc8B78613A45955C855A87), [0xCE148A96B191C05414c9282c2C57e537100b40FE](https://basescan.org/address/0xCE148A96B191C05414c9282c2C57e537100b40FE) ##### SafeL2 (0xAAAa…1aaA) Addresses: [0xAAAaEE7549a61282F2B4Ca1766f46249D9e71aaA](https://basescan.org/address/0xAAAaEE7549a61282F2B4Ca1766f46249D9e71aaA) A Multisig with 2/3 threshold. - Can interact with Butter AuthorityManager - change AuthorityManager permissions and execute restricted Bridge and FeeService management operations Participants (3): [0xCE148A96B191C05414c9282c2C57e537100b40FE](https://basescan.org/address/0xCE148A96B191C05414c9282c2C57e537100b40FE), [0x0cDAe5da23b64bFeCD421d6487FFEABF6558828d](https://basescan.org/address/0x0cDAe5da23b64bFeCD421d6487FFEABF6558828d), [0x386ce1a187eC7329CFb8E467EB02FB07c698256A](https://basescan.org/address/0x386ce1a187eC7329CFb8E467EB02FB07c698256A) ##### EOA 1 Addresses: [0x7F4cBa3D7f20bF5146e4e5F8929b676CA05a5545](https://basescan.org/address/0x7F4cBa3D7f20bF5146e4e5F8929b676CA05a5545) - Can upgrade **with no delay** - Butter MAP LightNode - Can interact with Butter MAP LightNode - change the pending LightNode administrator or the VerifyTool used by proof verification ## Smart contracts Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/butternetwork ### Base Chain #### Butter AuthorityManager Addresses: [0xACC31A6756B60304C03d6626fc98c062E4539CCA](https://etherscan.io/address/0xACC31A6756B60304C03d6626fc98c062E4539CCA#code) OpenZeppelin AccessManager-derived authority for Butter's restricted Bridge and FeeService functions. Its role configuration controls who can change bridge validation dependencies, relay and token settings, fee parameters, pause state, and implementation upgrades. - Roles: - **adminRole**: SafeL2 #### Butter Bridge Addresses: [0x0000317Bec33Af037b5fAb2028f52d14658F6A56](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code), [0x862761D6D52E9e812A8c22E6e6A39E186e59a33d](https://etherscan.io/address/0x862761D6D52E9e812A8c22E6e6A39E186e59a33d#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: 4, Last upgrade: 5mo 17d ago, Avg upgrade interval: 4mo 26d) - 2026-05-21 05:48 UTC, upgrade of [Butter Bridge](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code): transaction [0x2d56c8102ef3cff82ebce01f64b4f33d299712db723c2992e5421b5bd12f72fa](https://etherscan.io/tx/0x2d56c8102ef3cff82ebce01f64b4f33d299712db723c2992e5421b5bd12f72fa), implementations: [0x862761D6D52E9e812A8c22E6e6A39E186e59a33d](https://etherscan.io/address/0x862761D6D52E9e812A8c22E6e6A39E186e59a33d#code) ([diff](https://disco.ethbeat.org/diff/base:0x862761D6D52E9e812A8c22E6e6A39E186e59a33d/base:0x862761D6D52E9e812A8c22E6e6A39E186e59a33d)) - 2026-05-21 05:46 UTC, upgrade of [Butter Bridge](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code): transaction [0x1c21e691416e2adb3017aa56b4d21e434d6ad541124cd08ac85be6acd80fd784](https://etherscan.io/tx/0x1c21e691416e2adb3017aa56b4d21e434d6ad541124cd08ac85be6acd80fd784), implementations: [0x862761D6D52E9e812A8c22E6e6A39E186e59a33d](https://etherscan.io/address/0x862761D6D52E9e812A8c22E6e6A39E186e59a33d#code) ([diff](https://disco.ethbeat.org/diff/base:0x85E0d15EA312F999ad038e7f8E921D4743C12D43/base:0x862761D6D52E9e812A8c22E6e6A39E186e59a33d)) - 2025-08-07 02:03 UTC, upgrade of [Butter Bridge](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code): transaction [0x2419922339020bb0a82ba64dc820b3add2f4244fcdb8c87e17ace5649fb7f89c](https://etherscan.io/tx/0x2419922339020bb0a82ba64dc820b3add2f4244fcdb8c87e17ace5649fb7f89c), implementations: [0x85E0d15EA312F999ad038e7f8E921D4743C12D43](https://etherscan.io/address/0x85E0d15EA312F999ad038e7f8E921D4743C12D43#code) ([diff](https://disco.ethbeat.org/diff/base:0x1FbC14ea7F2B6bf8DCaAF7eA3484E5C6F003dF0d/base:0x85E0d15EA312F999ad038e7f8E921D4743C12D43)) - 2024-11-12 04:53 UTC, upgrade of [Butter Bridge](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code): transaction [0x0f790ff23e57c687aceeecc9922c677cf5b8c6c8883b5ba254e59757c90b6b43](https://etherscan.io/tx/0x0f790ff23e57c687aceeecc9922c677cf5b8c6c8883b5ba254e59757c90b6b43), implementations: [0x1FbC14ea7F2B6bf8DCaAF7eA3484E5C6F003dF0d](https://etherscan.io/address/0x1FbC14ea7F2B6bf8DCaAF7eA3484E5C6F003dF0d#code) ([diff](https://disco.ethbeat.org/diff/base:0xA8E357C8d4B4EC766E63bd1b73ECD4734eC3AAA4/base:0x1FbC14ea7F2B6bf8DCaAF7eA3484E5C6F003dF0d)) - 2024-11-02 07:48 UTC, deployment of [Butter Bridge](https://etherscan.io/address/0x0000317Bec33Af037b5fAb2028f52d14658F6A56#code): transaction [0x78c19b4c6a8113d02f4ef7fa4c9a9c8bb64cec8f7094d42043a9e4f826b103a6](https://etherscan.io/tx/0x78c19b4c6a8113d02f4ef7fa4c9a9c8bb64cec8f7094d42043a9e4f826b103a6), implementations: [0xA8E357C8d4B4EC766E63bd1b73ECD4734eC3AAA4](https://etherscan.io/address/0xA8E357C8d4B4EC766E63bd1b73ECD4734eC3AAA4#code) Butter's Base bridge endpoint. Outbound transfers lock or burn assets and emit messages for the MAP relay chain; inbound transfers execute only after a LightNode-validated receipt proof for the configured MAP relay contract. The bridge can mint configured mintable tokens, release escrowed assets, and invoke receiver callbacks, so compromise of validation, relay configuration, or management authority can lead to loss of bridged funds. - Roles: - **authority**: Butter AuthorityManager #### Butter MAP LightNode Addresses: [0x0001805c0B57DBd48B5c5c26E237a135dDC678ae](https://etherscan.io/address/0x0001805c0B57DBd48B5c5c26E237a135dDC678ae#code), [0xF6366aD2361Df88E8815258948093C33d93d5374](https://etherscan.io/address/0xF6366aD2361Df88E8815258948093C33d93d5374#code) (Implementation (Upgradable)), [0x7F4cBa3D7f20bF5146e4e5F8929b676CA05a5545](https://etherscan.io/address/0x7F4cBa3D7f20bF5146e4e5F8929b676CA05a5545#code) (Admin) **Past upgrades** (Count of upgrades: 3, Last upgrade: 2y 1mo ago, Avg upgrade interval: 7mo 24d) - 2024-09-23 00:33 UTC, upgrade of [Butter MAP LightNode](https://etherscan.io/address/0x0001805c0B57DBd48B5c5c26E237a135dDC678ae#code): transaction [0x53838b8cb5bc53dc0fe72a902f3b51bbbdae31d23509e03657a28e90170c1495](https://etherscan.io/tx/0x53838b8cb5bc53dc0fe72a902f3b51bbbdae31d23509e03657a28e90170c1495), implementations: [0xF6366aD2361Df88E8815258948093C33d93d5374](https://etherscan.io/address/0xF6366aD2361Df88E8815258948093C33d93d5374#code) ([diff](https://disco.ethbeat.org/diff/base:0x2C77024B4D7E2549C9303B46C0F95607472AbFCe/base:0xF6366aD2361Df88E8815258948093C33d93d5374)) - 2024-09-16 04:20 UTC, upgrade of [Butter MAP LightNode](https://etherscan.io/address/0x0001805c0B57DBd48B5c5c26E237a135dDC678ae#code): transaction [0xe4fb346381ce69967553f7e83bc9cfef954c13ea62c4233bf538daffe233b733](https://etherscan.io/tx/0xe4fb346381ce69967553f7e83bc9cfef954c13ea62c4233bf538daffe233b733), implementations: [0x2C77024B4D7E2549C9303B46C0F95607472AbFCe](https://etherscan.io/address/0x2C77024B4D7E2549C9303B46C0F95607472AbFCe#code) ([diff](https://disco.ethbeat.org/diff/base:0xd5C45b145594a142605825DB3a4Df35450eDa901/base:0x2C77024B4D7E2549C9303B46C0F95607472AbFCe)) - 2024-09-06 14:53 UTC, upgrade of [Butter MAP LightNode](https://etherscan.io/address/0x0001805c0B57DBd48B5c5c26E237a135dDC678ae#code): transaction [0x704ad684abf8327381ba478f02972d0af2b8d5a9c4c32eeab53e4c2e76a03814](https://etherscan.io/tx/0x704ad684abf8327381ba478f02972d0af2b8d5a9c4c32eeab53e4c2e76a03814), implementations: [0xd5C45b145594a142605825DB3a4Df35450eDa901](https://etherscan.io/address/0xd5C45b145594a142605825DB3a4Df35450eDa901#code) ([diff](https://disco.ethbeat.org/diff/base:0x92649181CcF7775bE3b212fF2e02f8F57366bFF3/base:0xd5C45b145594a142605825DB3a4Df35450eDa901)) - 2024-04-10 09:00 UTC, deployment of [Butter MAP LightNode](https://etherscan.io/address/0x0001805c0B57DBd48B5c5c26E237a135dDC678ae#code): transaction [0xd3f44ff09982171f62d0c4bfd3513db8d49dd6d5012d81c51f45055e0ba89df4](https://etherscan.io/tx/0xd3f44ff09982171f62d0c4bfd3513db8d49dd6d5012d81c51f45055e0ba89df4), implementations: [0x92649181CcF7775bE3b212fF2e02f8F57366bFF3](https://etherscan.io/address/0x92649181CcF7775bE3b212fF2e02f8F57366bFF3#code) Upgradeable MAP relay-chain light client used by Butter bridges. It verifies relay-chain headers with the stored BLS validator set and verifies receipt Merkle proofs against accepted headers. It is the destination-chain validation boundary for bridged messages. - Roles: - **admin**: EOA 1 Can be upgraded by: EOA 1 with no delay #### Butter VerifyTool Addresses: [0xc3393567DC2F1d071254E880c9f501641491471f](https://etherscan.io/address/0xc3393567DC2F1d071254E880c9f501641491471f#code) Cryptographic and RLP/Merkle-proof helper contract called by the Butter MAP LightNode to validate relay-chain headers and transaction receipts. #### Butter FeeService Addresses: [0xfeE31a1FD7FcA0E05428ff751242e46F6D5769a6](https://etherscan.io/address/0xfeE31a1FD7FcA0E05428ff751242e46F6D5769a6#code) Fee configuration contract used by Butter Bridge to calculate cross-chain message fees and select the fee recipient. - Roles: - **authority**: Butter AuthorityManager The current deployment carries some associated risks: - Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).