ADI Shuffle Update
01Summary
Upgrade Aave Delivery Infrastructure (a.DI) to v1.1 across 10 supported networks by deploying new CrossChainController implementations with a Shuffle mechanism. This mechanism pseudo-randomly selects optimal subsets of bridge adapters for each cross-chain path, reducing costs, removing bottlenecks for adding new bridges, and improving security through rotation-based selection.
- Type
- contract upgrade
Key changes
- Add Shuffle mechanism to pseudo-randomly select optimal subsets of bridge adapters for cross-chain messages instead of using all available bridges(high)
- Introduce _optimalBandwidthByChain mapping on CrossChainController to store optimal bandwidth for each supported chain(high)
- Configure optimal bandwidth parameters across all origin-destination chain pairs (e.g., Ethereum→Polygon: 4, Ethereum→Arbitrum: 1)(high)
- Deploy new CrossChainController implementations with Shuffle support on all 10 supported networks(high)
- Upgrade to revision 3 of a.DI using reinitializer mechanism(medium)
Notable concerns
- Implementation changes across multiple networks require coordinated deployment
- Security audit completed by Certora but any edge cases in pseudo-random shuffling logic should be monitored
- Optimal bandwidth configuration requires careful tuning to balance cost savings with message delivery reliability
Generated by Kvorum
02Description
Simple Summary
Proposal to update a.DI with the new Shuffle mechanism, included into the v1.1 release presented HERE.
Motivation
a.DI v1 has one constraint, that even if not major, limits the scalability of the system: whenever a new underlying bridge provider is added to the set of a communication path, each message on that path will be passed through all the bridges, no matter if the consensus required on the recipient side is lower. For example, currently all messages Ethereum → Polygon are sent via CCIP, LayerZero, Hyperlane, and the Polygon native bridge, even if the consensus required on the Polygon side is 3-of-4. This means that even if consensus was reached already before the slowest bridge delivers the message (Polygon native in this case), the cost incurred is of the whole set of 4 bridges, not only 3.
a.DI v1.1 (and more specifically its Shuffling feature) introduces a mechanism for, whenever a message needs to be sent, the system choosing pseudo-randomly a sub-set of all the available bridges for that specific path (e.g. Ethereum → Polygon) with optimal bandwidth size, and only forwards the message via those bridges.
By doing this:
- Cost is reduced on all those configurations with optimal bandwidth < bandwidth.
- Any bottleneck to add new underlying bridge providers is removed, as increasing bandwidth doesn’t really have any effect on the optimal bandwidth of the path.
- Security-wise, the pseudo-random nature of the shuffling mechanism improves the system, in the line of other rotation-based systems like validators-selection in PoS blockchains.
Specification
This proposal upgrades a.DI on every supported network with the new implementation containing the Shuffle mechanism; afterwards, it configures the new parameters required.
The upgrade adds a new _optimalBandwidthByChain mapping on CrossChainForwarder that will store the optimal bandwidth for every supported chain. This will be used to determine how many adapters will be used to pass a message to a destination network
The OptimalBandwidth used to update a.DI will be:
| Origin Network | Ethereum | Polygon | Avalanche | Arbitrum | Optimism | Base | Gnosis | Metis | Binance | Scroll |
|---|---|---|---|---|---|---|---|---|---|---|
| Ethereum | - | 4 | 2 | 1 | 1 | 1 | 2 | 1 | 2 | 1 |
| Polygon | 3 | - | - | - | - | - | - | - | - | - |
| Avalanche | 2 | - | - | - | - | - | - | - | - | - |
| Arbitrum | - | - | - | - | - | - | - | - | - | - |
| Optimism | - | - | - | - | - | - | - | - | - | - |
| Base | - | - | - | - | - | - | - | - | - | - |
| Gnosis | - | - | - | - | - | - | - | - | - | - |
| Metis | - | - | - | - | - | - | - | - | - | - |
| Binance | - | - | - | - | - | - | - | - | - | - |
| Scroll | - | - | - | - | - | - | - | - | - | - |
The method used to initialize a.DI with the new bandwidth configurations is:
function initializeRevision(
OptimalBandwidthByChain[] memory optimalBandwidthByChain
) external reinitializer(3) {
_updateOptimalBandwidthByChain(optimalBandwidthByChain);
}
The new CrossChainController implementations for every supported network are the following:
| Network | New CCC implementation with Shuffle support |
|---|---|
| Ethereum | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
| Polygon | 0x191f2bd27f1ce4318f9a0c6b82688c66cd7ad3ba |
| Avalanche | 0x23f5150ace7382c7160a2192c3f9f77444f420d9 |
| Arbitrum | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
| Optimism | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
| Base | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
| Gnosis | 0x88e9f8e208ba5ae72b56861d63cbf70fd2320f5c |
| Metis | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
| Binance | 0xda81fb369942e43d4797e79f2c4cbef9fe58b90a |
| Scroll | 0x92f4736b72d131d836b3e4d4c3c23fe53150ce4d |
Security
Certora audit report on the Shuffle update can be found here
References
- Implementation: CrossChainController Shuffle update payloads implementation
- Tests: CrossChainController Shuffle update tests
- Diffs: CrossChainController implementation address change diffs
- Discussion
Copyright
Copyright and related rights waived via CC0.
03Mismatch analysis
The proposal describes a multi-step technical upgrade: deploying new CrossChainController implementations with Shuffle support on 10 networks and initializing an optimal-bandwidth mapping via initializeRevision with specific per-chain values. The decoded on-chain action set contains only one entry: a call to execute() on a single payload contract address on Ethereum, with no further decoded sub-calls or arguments. This is the standard Aave governance pattern (BGD-style payload contracts) where the top-level proposal simply triggers a pre-deployed, pre-audited payload contract that internally performs the described upgrades and configuration calls across chains (often via cross-chain messaging from Ethereum). Because the calldata here is not decoded beyond the outer execute() call, there is no way to directly verify the specific implementation addresses or bandwidth values against the description - but there is also nothing in the visible calldata that contradicts the description. Given the well-documented audit (Certora report) and linked implementation/test code referenced in the proposal, and the absence of any visible conflicting action, I find no concrete discrepancy to flag. However, confidence is low because the single opaque execute() call prevents genuine verification of the granular claims (exact addresses, bandwidth numbers) made in the description.
Generated by Kvorum
04Actions
- Target
- 0xf50a…50c1
- Value
- 0 wei
- Function
- fallback()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
No forum thread is confidently linked to this proposal.
08Similar proposals
- aaveexecutedUpdate a.DI implementation and CCIP adapters78%
- aaveexecutedNative bridge adapters update73%
- aaveexecutedHyperlane bridge adapter update to V372%
- aaveexecuteda.DI Sonic path activation70%
- aaveexecutedMaintenance: Grant AL RETRY_ROLE on a.DI (Part 1)70%
- aaveexecuteda.DI Celo path activation69%
- aaveexecutedLayerZero bridge adapter update to V268%
- aaveexecutedPlasma aDI path activation67%
- aaveexecutedMonad aDI path activation67%
- aaveexecuteda.DI Linea path activation66%