Auditing Holonym's Aztec Bridge. The challenge: bringing compliant privacy to cross-chain transfers. Holonym's Aztec Bridge allows users to move ERC-20 tokens from Ethereum to Aztec L2 while presenting Proof of Humanity and Proof of Clean Hands credentials. The result is a bridge that supports compliant private minting and withdrawals on either layer, with sensitive account details shielded by Aztec's native privacy features. The design sits at the intersection of three difficult domains: cross-chain bridging, zero-knowledge cryptography, and credential-based access control. A signature scheme designed for one purpose can be quietly reusable for another. A state variable with the wrong update semantics can open a window for double-spending. Privacy guarantees can leak through subtle metadata channels. Holonym engaged Nethermind Security to review the bridge contracts on both Ethereum and Aztec, examine the cryptographic constructions, and assess whether the architecture held up against the threats specific to compliant privacy systems. Key technical challenges. Several factors shaped the scope of the engagement: * Reviewing Solidity contracts on Ethereum alongside Noir contracts on Aztec, with different execution models and state semantics on each side. * Assessing privacy guarantees end-to-end, including whether any user-identifying data could leak through public state or transaction metadata. * Verifying Sybil resistance, given that the bridge relies on Human Passport's Proof of Humanity to enforce one-person-one-account behaviour. * Checking for double-spend and replay vectors across nonces, signatures, and credential reuse. * Constraining proof size and generation time so that proofs remain practical to produce in a local browser environment. The combination of Aztec's DelayedPublicMutable state semantics, signature reuse across the broader Holonym ecosystem, and the cross-chain message flow produced several non-obvious attack paths. Findings that mattered. Its review uncovered issues across several risk areas: * Aztec state update semantics: Several DelayedPublicMutable variables were configured with delay values too short for reliable use, and one nonce-tracking variable used DelayedPublicMutable where stale reads could allow the same nonce to be consumed by concurrent transactions. Both issues stemmed from the gap between when an update is scheduled and when it takes effect on Aztec. * Signature scope and replay protection: The actionId used during signature verification was not bound to the bridge, meaning signatures issued for other Holonym use cases could be replayed against the bridge contract. This weakened the Sybil protection the credential system was designed to provide. * Cryptography and circuit efficiency: Beyond correctness, Surge examined the ZK circuits for opportunities to reduce proof generation time without compromising the privacy properties, since proofs are generated client-side. * Access control and credential verification: Surge checked that signature verification, credential checks, and contract access paths were consistently enforced across both the Ethereum and Aztec sides of the bridge. These findings were reviewed with the Holonym team and resolved before deployment, with architectural changes applied where simple patches would not have addressed the root cause. Its process. Nethermind Security conducted a full audit of the Holonym Aztec Bridge, covering Solidity contracts on Ethereum and Noir contracts on Aztec. The review combined manual analysis of the smart contracts with a focused assessment of the privacy and cryptographic guarantees, drawing on its team's experience with the Aztec network. Surge worked through the codebase function by function, mapping the cross-chain message flow and credential verification logic, and produced a proof-of-concept for the most severe finding to confirm exploitability. Communication ran on a biweekly cadence through scheduled calls, with async discussion in between for clarifications and follow-ups. Alongside security findings, Surge shared optimisation suggestions aimed at reducing proof generation time, which matters for users generating proofs locally. Total findings: 6 * 1 Critical * 2 High * 3 Medium All vulnerabilities were resolved before deployment. The outcome: A bridge ready for compliant private transfers. The engagement closed with all critical and high severity issues resolved, alongside the medium findings. The architectural changes around DelayedPublicMutable state and actionId binding closed off the most consequential attack paths, while the cryptography review contributed performance improvements to the proof system. A secondary outcome was a finding in the Aztec documentation itself, identified during the review and surfaced back to the Aztec team. The Holonym team moved quickly on remediation, and the architectural decisions made during the engagement strengthened the bridge against both privacy and Sybil-related risks. "Privacy tech is high stakes. Users depend on apps to keep them safe. Apps depend on the protocol to operate as designed. And protocols depend on their maths and design assumptions to hold up in the real world. Navigating this as a builder is difficult on your own. Working with Nethermind was a great experience to close the gap from assumptions to real world production-ready code" Shady El Damaty - CEO, Holonym Work with Nethermind Security. Nethermind Security audits the protocols securing billions on-chain. If you are shipping something that needs to hold up, let's talk.

Nethermind moves cross-chain operations from LayerZero to Chainlink. Nethermind joins Chainlink as a node operator after ending its LayerZero verifier role. By Yasmin Werner August 19, 2026 3 Mins Read Tldr. * Nethermind shifts cross-chain operations from LayerZero to Chainlink after review. * Nethermind joins Chainlink as a node operator supporting CCIP and Data Feeds. * Chainlink gains Nethermind as another major provider of cross-chain infrastructure. * Nethermind ends its LayerZero verifier role and focuses cross-chain work on CCIP. * Nethermind brings Ethereum engineering expertise to Chainlink's growing network. Nethermind has moved its cross-chain operations from LayerZero to Chainlink after completing an extensive infrastructure review. The blockchain engineering company will operate Chainlink nodes supporting CCIP and its widely used Data Feeds. The move strengthens Chainlink's infrastructure network as financial institutions expand their use of public blockchain systems. Nethermind shifts cross-chain infrastructure to Chainlink. Nethermind will serve as a Chainlink node operator and strategic technology provider under the new arrangement. The company will provide infrastructure services, engineering tools, and integration support for teams building blockchain applications. Meanwhile, its cross-chain operations will focus on Chainlink's Cross-Chain Interoperability Protocol, known as CCIP. CCIP supports token transfers and messaging between separate blockchain networks through Chainlink's decentralized infrastructure. Chainlink also uses independent node operators and risk controls to monitor cross-chain transactions across supported networks. Therefore, Nethermind will apply its existing blockchain engineering experience to infrastructure supporting those services. The company previously operated decentralized verifier infrastructure within LayerZero's cross-chain messaging system. LayerZero allows applications to select decentralized verifier networks that confirm messages moving between different blockchains. However, Nethermind has now ended that verifier role and shifted its cross-chain infrastructure operations toward Chainlink. LayerZero security debate adds industry context. The migration follows several major cross-chain infrastructure changes involving LayerZero and Chainlink during 2026. In April, attackers exploited Kelp DAO's LayerZero-powered bridge and drained about $290 million in rsETH. The incident involved a forged cross-chain message and a configuration relying on a single verifier. Kelp DAO later moved rsETH cross-chain infrastructure to Chainlink while disputing LayerZero's description of its security configuration. LayerZero rejected those claims and said the project had changed from multiple verifiers to one verifier. LayerZero subsequently introduced stronger requirements for applications using its decentralized verifier network model. Still, Nethermind has not linked its decision directly to the Kelp DAO incident or another LayerZero security event. Its announcement described the migration as the result of an extensive review and long-term infrastructure planning. The company also did not publish technical criteria used to compare Chainlink and LayerZero during that review. Chainlink gains more cross-chain infrastructure support. Other major organizations have also moved cross-chain operations toward Chainlink during recent months. BitGo selected CCIP as the exclusive cross-chain infrastructure for Wrapped Bitcoin after previously using LayerZero. Aave also expanded its CCIP integration for deposits, withdrawals, vault rebalancing, and other cross-chain asset movements. Wyoming's Stable Token Commission completed another LayerZero-to-Chainlink migration on August 18 after conducting a state security review. The commission selected CCIP as the exclusive cross-chain provider for its Frontier Stable Token. However, Wyoming did not publish the complete technical findings from its infrastructure assessment. Nethermind brings significant Ethereum infrastructure experience into Chainlink's expanding network of independent node operators. Founded in 2017, the company develops an Ethereum execution client and provides security, research, and institutional blockchain services. Its new role extends that work into oracle infrastructure and cross-chain systems supporting institutional blockchain adoption. Yasmin is a crypto content analyst and writer with over 2 years of experience. She has a strong understanding of the crypto market and blockchain technologies. As an avid trader who stays updated on the latest trends and news, Yasmin delivers insightful and informative content. August 19, 2026