Security review flags governance risks in Polygon Bridge upgrade and pause controls

A security researcher published a governance attack surface review of the Polygon Bridge, which connects Ethereum and Polygon PoS and has a total value locked of roughly $2.6 billion. The review concludes that the core token-locking contracts are robust, but the governance layer poses medium-to-high risk. Key concerns include a 5-of-9 multisig controlling upgrades without a time-lock or delay, and fee parameters lacking bounds checks. The emergency pause can be triggered by a subset of signers, and off-chain proposal interfaces lack cryptographic verification, leaving them open to phishing. The author warns that compromised signers or manipulated governance could lead to fund loss or disruption.