Cointelegraph reported that BNB Smart Chain activated its Pasteur hard fork on Aug. 25, 2026, combining bridge-verification fixes, validator authorization changes and a new block-building route designed to improve capacity while retaining BSC’s roughly 450-millisecond block interval. The most important question raised by the upgrade is therefore not simply whether BSC can process more transactions.
It is this: when BSC accepts a message from another chain, what exactly has it proven?
That question matters because “proof” is often used as shorthand for an entire bridge security model. In practice, a destination chain may verify a transaction’s inclusion cryptographically, rely on a validator committee for finality, accept an administrator’s emergency action, or combine all three. Those are materially different guarantees. They fail differently, carry different economic assumptions and deserve different labels in an audit report.
Pasteur’s value is that it narrows certain gaps between claimed validator authority and actual validator authority. It does not turn every bridge event into a trustless mathematical fact. Developers and investors should be careful not to confuse those achievements.
A bridge is a chain of claims
Consider a straightforward token bridge. A user locks tokens on a source chain. A message records the amount, recipient, source asset and a unique nonce. A relayer delivers evidence of that message to the destination chain. The destination bridge contract then mints a representation of the asset or releases previously escrowed liquidity.
Every arrow in that sequence asks a separate question.
The first question is whether the source bridge contract really emitted the message. The second is whether the message was included in a source-chain block. The third is whether that block is sufficiently final. The fourth is whether the destination verifier is using the correct validator set or consensus rules to judge finality. The fifth is whether the destination contract treats the message as new and authorized.
A robust bridge should validate each claim explicitly. A weak bridge may establish only some of them and infer the rest from a trusted signer, multisignature wallet or offchain operator.
That distinction determines the actual trust boundary. A proof of inclusion can show that a particular receipt or event belongs to a committed block. It cannot, by itself, show that the block was final, that its signers were valid, that the source chain will not reorganize, or that the same message has not already been redeemed. Each of those conclusions requires another verification rule.
Inclusion is not authorization
The cleanest way to see the problem is to separate a cryptographic witness from permission to act.
A proof of inclusion generally answers: “Was this message committed under this block root?” A verifier recomputes a path through a Merkle tree, or an equivalent authenticated data structure, and checks that it reaches the committed root in a supplied block header.
That is powerful because the relayer need not be trusted. It can be late, unreliable or economically motivated. It may even be malicious. If the verifier checks the header and proof correctly, the relayer cannot invent an event that was never committed.
But someone must still establish that the header itself is authoritative.
A light-client bridge does this by tracking enough of the source chain’s consensus information to validate headers and finality. A validator-attested bridge instead accepts a threshold of signatures from an approved validator set. A multisignature bridge trusts a smaller signer group. In each model, the proof is only as strong as the mechanism that authenticates the header or message.
Pasteur’s BEP-682 addresses a precise weakness in this authority layer. Its light-block validator-set check rejects duplicate validator addresses before signature verification, while approval power is summed from each unique signer’s recorded voting power. That is not an implementation detail: it prevents one validator from being counted twice in weighted approval.
If one validator can be inserted more than once into the list used to tally a quorum, one real signature could be counted multiple times. The verifier might conclude that enough independent validators approved a light block when the apparent majority was partly an accounting illusion. Preventing duplicate entries restores the intended meaning of the threshold: distinct authorized validators must supply the required voting power.
That is an authorization fix. It strengthens the claim, “the correct validator set approved this header.” It does not independently prove that a particular source-chain event exists. A complete bridge must still verify both the validator-approved header and the event’s inclusion beneath that header.
The exact difference is crucial in an audit
A useful audit divides bridge controls into three layers.
First comes event validity. The bridge should bind the source event to the precise asset, amount, recipient, chain identifier and nonce expected by the destination. A valid proof for the wrong message must not be accepted as a valid proof for the intended transfer.
Second comes consensus validity. The destination must determine that the header is from the claimed source network, represents a block accepted under that network’s rules, and has crossed the bridge’s finality threshold. This is where validator-set updates, duplicate checks and signature validation matter most.
Third comes execution authority. The destination bridge contract must have narrowly defined rules for minting or releasing funds. It needs replay protection, domain separation between networks and clear controls over upgrades, pauses and rescue powers.
Pasteur reaches into the first and second layers. BEP-682 hardens consensus validity by preventing duplicate validator support in cross-chain light-block verification. BEP-695 tightens validator and governance authority around key rotation, slashing and voting, without changing destination-contract mint or release permissions, replay protection or admin controls.
Those measures matter because key rotation is a moment when security assumptions can become ambiguous. If an old key retains authority longer than intended, compromise of that key can remain useful to an attacker. If governance permissions are not tightly enforced, a party excluded by policy may still affect protocol control. Neither problem is solved by a Merkle proof. Both are authorization problems.
This is why “cryptographically verified” should not be treated as a universal bridge label. A cryptographic proof can verify inclusion. Cryptography can also verify that a signature corresponds to a public key. Yet the choice of which public keys count, how they rotate and which governance action updates them remains a protocol and administrative rule.
Four failures, four different defenses
A forged-message attack begins with an attacker trying to convince the destination chain that a source event occurred when it did not. The main defense is a correctly implemented inclusion proof checked against a valid source header. Relayer reputation should be irrelevant.
A replay attack reuses a message that was legitimate once. The defense is not stronger finality. It is stateful consumption: the destination contract must record a unique message identifier, nonce or transfer hash and reject it on a second use.
A stale-finality attack uses a block that was once plausible but is no longer final enough under the destination bridge’s policy. This becomes more important when chains reduce block times or modify finality behavior. Faster block production can improve user experience, but it can also tempt applications to shorten confirmation windows. A short block interval is not automatically equivalent to irreversible settlement.
A compromised-authority attack targets the validator set, signer threshold, validator-key rotation process or governance pathway that tells the bridge which headers count. This is the category Pasteur most directly confronts. Duplicate validator counting, lingering old keys and improperly authorized governance participants can all transform a threshold from a security guarantee into a paper safeguard.
The defenses should map cleanly to the threats. If a project says it has “bridge proof verification,” an auditor should ask whether it means inclusion verification, finality verification, validator authorization, replay prevention or all of the above.
Capacity changes create a second safety question
Pasteur also changes how specialist builders can submit blocks. Under BSC’s former route, a builder executed transactions before sending a proposal, while the validator executed them again before signing. The new route allows a builder to submit an already executed block. Validators check it against consensus rules, sign and broadcast it, then complete full execution verification afterward. Builders can still use the older path.
The performance rationale is clear. Repeated work inside a short block window can leave blocks underfilled. In QANet tests that mirrored BSC’s distributed-validator environment, the reported throughput rose from 1,237 to 2,324 transactions per second, while average gas used per block increased from 46.35 million to 84.15 million. These were controlled test results, not mainnet measurements.
| QANet measure | Earlier route | New route |
|---|---|---|
| Throughput | 1,237 TPS | 2,324 TPS |
| Average gas per block | 46.35 million | 84.15 million |
The bridge lesson is that capacity and verification costs are connected. More transactions per block can mean more bridge events, larger operational backlogs and more state transitions for indexers, relayers and monitoring systems to process. A bridge verifier should not assume that block production is the only bottleneck. Proof generation, header tracking, database indexing and challenge monitoring can all become pressure points.
The 450-millisecond window moves full execution verification to after broadcast in the Pasteur route
The safety question is not whether the new path is good or bad in isolation. It is whether every participant knows which checks occur before a block is signed, which occur afterward, and what happens if a discrepancy is discovered. Protocols that accelerate execution must be especially precise about sequencing, rollback assumptions and monitoring.
What Pasteur mitigates, and what it cannot promise
Pasteur’s mitigations are specific. Under BEP-682, cross-chain light-block verification must reject duplicate validator addresses and calculate approval power from unique validators’ recorded voting power. The mechanism prevents a single validator identity from inflating an approval tally through repeated entries; it therefore preserves the intended meaning of a weighted signature threshold. It does not prove that a bridged event occurred, establish that the referenced block is final under every bridge policy, or prevent the destination contract from redeeming a valid message twice.
BEP-695 addresses a different authority surface: validator-key rotation and the validator and governance actions associated with slashing and voting. Its effect is to make the protocol’s authorized-validator and governance state track the updated rules rather than leaving those questions to an assumed offchain process. That change can reduce the risk that superseded validator credentials or improperly authorized participants remain effective within those protocol pathways. It does not change the separate destination-bridge rules that consume nonces, bind message fields, authorize minting or releases, or constrain privileged contract administrators.
The block-building changes documented for Pasteur likewise target utilization within BSC’s stated roughly 450-millisecond block interval; they do not, on their own, shorten the confirmation policy a bridge needs before treating a source block as final. Higher capacity can increase the volume of headers, events and proofs that bridge infrastructure must process, but it is not evidence that a message has become irreversible.
For investors, the lesson is to value bridges by their security model rather than their marketing category. For developers, the practical test is simple: list every fact that must be true before minting or releasing funds, then identify whether each fact is proven onchain, attested by validators, assumed operationally or controlled by governance.
A bridge becomes credible when those categories are visible. Pasteur makes BNB Chain’s own boundary clearer. That clarity is more valuable than any single throughput number.
David Smith is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at David Smith's usual length and in David Smith's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Without human check
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.