Across Review

Across scores 7.2 out of 10 in our bridge ratings, down from 7.4 in July and sixth of nine. It earns its marks for the plainest statement of a security assumption in the category and a linked audit archive. It loses them on two points: cost is never published as a rate, and the core contracts are still under a source-available licence rather than an open-source one.

This assessment is desk research from Across's documentation, contract repository and terms, rechecked on 6 November 2026. We did not bridge funds through Across, and nothing here measures transfer speed or price in practice.

How Across scores in bridges

The bridges category uses five criteria, each worth 20%. One mark moved on this check.

Arithmetic: (5 + 10 + 4 + 9 + 8) / 5 = 36 / 5 = 7.2.

What changed: Fee transparency moved from 6 to 5. The fee documentation itself has not changed; the category now applies one scale to fees, and a fee explained as components without any published rate scores 5, as it does for Axelar and Stargate. The stated chain count is now "26+" on the documentation overview, where the July review recorded 28; that is still broad coverage against the category standard, so the mark stays at 9.

Strongest criteria: trust model and coverage

Trust model disclosure (10)

Across says exactly what a user relies on. Relayers pay users on the destination chain from their own capital. Roughly every 1.5 hours an off-chain dataworker groups deposits and fills into a bundle and proposes it to the HubPool contract on Ethereum with a bond. The bundle is accepted unless someone disputes it within a challenge window, and disputes are resolved through UMA's Optimistic Oracle. The documentation states that a single honest actor is enough to reject an invalid bundle.

That description names the component (UMA's oracle), the economic deterrent (the bond), and the condition under which it would fail (no one disputes a bad bundle). This is the standard the criterion exists to reward, and it is why Across takes the full mark. The design is the same "valid unless challenged" logic used by optimistic rollups.

Chain coverage (9)

The documentation claims support for 26 or more chains. The homepage lists Ethereum, Arbitrum, Optimism, Base, Polygon, zkSync, Linea, BNB Smart Chain, Avalanche, Solana, Tron and HyperCore among them. The count is Across's own figure, and we did not test routes on each network.

Audit disclosure (8)

The audits page links eight reports, all hosted on OpenZeppelin's blog: two for Across V3, one for V2, one for the token and token distributor, and four for UMA, including its continuous audit of the Optimistic Oracle. Because Across depends on that oracle, the UMA reports are relevant rather than padding. The page does not show dates and does not name the firm in its own text; the firm is clear from the report links. Those gaps, and a single audit firm, keep the mark below the 10 the category gives a multi-firm archive such as Axelar's. A separate bug bounty offers up to $1,000,000 for critical findings, which the score notes but does not count as an audit.

Weakest criteria: fees and licence

Fee transparency (5): a formula, not a rate

The fee documentation defines the total fee as the input amount minus the output amount. It explains three parts. The LP fee follows a utilization-based curve and is zero when the relayer is repaid on the origin chain. The relayer fee covers destination gas, the cost of capital locked for about 1.5 hours, and risks such as reorganizations. An optional app fee is set by integrators as a decimal from 0 to 1.

What is missing is any number. The page says the LP curve parameters "vary by token and route" without listing them, and tells integrators not to cache fee responses. A user can see the cost only at quote time. That is a real deficiency against this criterion, not an unmeasured one: the structure is explained well, but nothing can be compared before quoting. For how fee types differ in general, see our guide to trading fees, spreads and gas.

Licence & code openness (4)

The contracts repository carries the Business Source License 1.1, with Risk Labs as licensor, converting to GPL v3.0 or later by 27 July 2027. The code is public and readable, but the licence restricts production use by others until then. The category marks source-available code with a future change date at 4, well below the 9 to 10 given to Apache or GPL licences. If the conversion happens on schedule, this mark is expected to rise at a later check.

What the score does not cover

• Actual cost and speed. Across claims fills in under two seconds; we did not measure fills or compare quotes.
• Relayer liveness. If no relayer fills a deposit, delivery is delayed. The rubric does not score this.
• Governance and ownership. Across's forum announced on 17 September 2026 that the protocol had been transferred to a US company, Across, Inc., with ACX holders offered USDC or equity until 8 January 2027. None of the five criteria measures operator structure, so the move did not change any mark. Holders should use only the portal linked from official channels.
• Incident history. The homepage states "no user funds lost"; that is the company's claim, and it is not scored.

Across vs Axelar and Chainflip

On current category marks, Axelar is first of nine at 8.6, Chainflip fifth at 7.6 and Across sixth at 7.2. Axelar's lead over Across comes from its Apache 2.0 licence (10 against 4) and a larger, dated audit archive (10 against 8); the two are level on fees at 5 and on chain coverage at 9, and Across is a point ahead on trust model disclosure. Against Chainflip, Across wins on chain coverage (9 against 5) and audits (8 against 4) and loses on fees (5 against 9) and licence (4 against 10). The bridge ratings page shows the live order.

Who it suits

Across's marks favor a user who wants to understand the security assumption before sending funds, and who is willing to read the output amount at quote time instead of comparing a published rate. Developers who need a permissively licensed codebase to build on today will find the BUSL terms a constraint until 2027. For the general risks of moving assets between chains, our explainer on how bridges work and why they are risky is the place to start. This rating is not a recommendation to use any bridge.