deBridge Review

deBridge scores 7.8 out of 10 in our bridge ratings, up from 5.4 and fourth of nine. Its fee table remains one of the most complete in the category, with a flat fee for each of 18 chains and a fixed 4 basis point charge. Two findings from July no longer hold. deBridge publishes a dated archive of 33 audit reports, and the licence's change date has passed, so the code now falls under the GPL by the licence's own terms. The weak point is the trust model: deBridge explains how its validators sign messages but not how many there are or how many signatures are needed.

This assessment is desk research from deBridge's documentation, its GitHub repositories and its legal pages, rechecked on 6 November 2026. We did not place an order through deBridge.

How deBridge scores in bridges

The bridges category uses five criteria, each worth 20%. Three marks moved and two held.

Arithmetic: (9 + 6 + 8 + 7 + 9) / 5 = 39 / 5 = 7.8.

What changed: Audit disclosure rose from 2 to 9 after deBridge's security overview was found to link its public audit repository. Trust model disclosure rose from 5 to 6 because the messaging protocol documentation now read for this review explains how validators sign and are slashed. Licence & code openness rose from 4 to 8: the July review counted the passed change date against deBridge, but under the Business Source License the change licence applies once that date has passed.

Strongest criteria: fees and audits

Fee transparency (9)

The fees page lists a flat fee for each source chain, paid in that chain's gas token: 0.001 ETH on Ethereum, Arbitrum, Base, Optimism and Linea, 0.05 AVAX, 0.005 BNB, 0.5 MATIC, 0.015 SOL, 4 TRX, 15 CRO and so on. A variable fee of 4 basis points is paid in the input token. The fee structure page adds a worked example: selling 1,000 USDC on Arbitrum for USDC on Polygon costs 0.001 ETH plus 0.40 USDC protocol fee, about 0.40 USDC solver margin and about 0.03 USDC of solver gas, leaving the user about 999.2 USDC.

deBridge also warns that "protocol fees can be changed" and that integrations must query them from the contract rather than hardcode them. The mark stops at 9 because the solver margin and gas are estimates, and apps that embed deBridge can add their own fee of up to 10%. For how these costs fit together, see our guide to trading fees, spreads and gas.

Audit disclosure (9)

The security overview links the debridge-security repository on GitHub. It holds 33 report PDFs with publication dates in its README, from November 2021 to December 2024. Most are by Halborn, with others from Zokyo, and from Ackee and Neodyme on the Solana program. The scope covers the core contracts, the DLN contracts on EVM chains and Solana, the validator node, the web front end and a backend penetration test. Every report is dated and the firms are named. The mark is one short of Axelar's 10 because the newest report is from December 2024 and the archive relies mostly on a single firm. The security overview also notes a bug bounty on Immunefi.

Licence & code openness (8)

The DLN contracts LICENSE is the Business Source License 1.1, with DxTech Inc. as licensor. Its change date is "the earlier of 31 December 2025 or a date specified at v1-license-date.dbr.eth," and the change licence is GPL-2.0-or-later. That date has passed, and under BUSL terms the code is now available under the GPL. The mark stops at 8 rather than the 9 or 10 given to Apache or GPL repositories because the file itself still shows the BUSL text, so a reader has to work out which licence applies.

Weaker criteria: trust model and coverage

Trust model disclosure (6)

deBridge's order network inherits its security from the deBridge Messaging Protocol. The protocol overview explains that governance-elected validators sign each transfer once it reaches finality, store signatures on Arweave, and that the destination contract delivers a message only when "the minimum required number of signatures" is valid. Validators who sign a non-existent transaction can be slashed, with delegated stake as collateral. The design also keeps no shared liquidity pool: solvers fill orders from their own funds.

What the documentation does not state is the number of validators, the signature threshold, or the block confirmations required per chain. Without them, a reader cannot see how many validators would have to collude for a forged message to pass. That is a disclosure deficiency, and it is why deBridge sits below Celer cBridge, which states a two-thirds stake threshold, on this criterion.

Chain coverage (7)

The fee table lists 18 chains, up from the 17 recorded in July, including Robinhood, Arc and MegaETH. Other pages in the documentation give "25+", so the fee table is used as the precise count. Eighteen sits below the 26 or more Across claims and the 40-plus Celer cBridge states, so the mark held.

What the score does not cover

• Access. deBridge's terms, with DxTech Inc. in Panama, exclude US persons and a list of restricted territories. Not scored.
• Fill speed and price. The docs give typical fills of 10 to 60 seconds; we did not measure them.
• Open-order risk. Funds sit in the source contract until a solver fills or the order is cancelled. Not scored.
• Incident history. deBridge says it has had zero security incidents; that is its own claim, and it is not scored.

deBridge vs Celer cBridge and Across

On current category marks, Celer cBridge is third of nine at 8.4, deBridge fourth at 7.8 and Across sixth at 7.2. deBridge leads both on fee transparency and audits, and both rivals are ahead on trust model disclosure, where Celer and Across state their failure conditions. Celer also leads on licence (10 against 8) and chain coverage; Across leads on chain coverage but trails on licence (4 against 8). Axelar and Wormhole share first place at 8.6.

Who it suits

deBridge's marks favor users and developers who want fees stated per chain before they sign and a dated audit record they can open. Users who want to know the exact validator threshold behind a transfer will not find it in the documentation. The terms exclude US persons. For the risks common to all bridges, read how blockchain bridges work and why they are risky. This rating measures disclosure, not safety.