How L2BEAT Assesses Rollup Risk
When evaluating a rollup's risk on L2BEAT, two main tools come into play: the "Stages" framework and the "Risk Rosette" radar chart. The former summarizes the project's overall decentralization maturity on a scale from 0 to 2; the latter breaks down specific risk sources across five independent dimensions (e.g., state validation, exit window). Using these two frameworks together—one vertical, one horizontal—gives you a well-rounded picture of a rollup's risk profile.
Step 1: Look at the "Stages" Framework – Quickly Assess Project Maturity
This is the most direct entry point for evaluating risk. It divides rollup decentralization into three stages; the higher the stage, the lower the reliance on centralized operators, and the closer the security of your assets is to Ethereum's mainnet.
Stage 0 ("Full Training Wheels"): The project is at its earliest phase. While it meets some basic requirements (such as posting state roots and transaction data to Ethereum), its proof system (the mechanism that verifies transaction correctness) may not be live yet or is fully controlled by the project team. Security guarantees are limited.
Stage 1 ("Limited Training Wheels"): The project has achieved some degree of decentralization. It must have a functioning proof system in place and establish a Security Council. This council is controlled by multiple parties (at least 8 members) via a multisig and can intervene in case of emergency bugs. In addition, any upgrade you disagree with must provide an exit window of at least 7 days.
Stage 2 ("No Training Wheels"): This is the most mature stage. The proof system is fully permissionless (anyone can participate in verification). The Security Council's powers are strictly limited—it can only address bugs that are provable on-chain. Upgrades must also provide an exit window of at least 30 days, giving users ample time to assess risks and exit.
"If a project chooses to decentralize at a point when the risks from operator privileges exceed those from code vulnerabilities, then decentralization can serve as a proxy for security. However, even a Stage 2 project can be unsafe if its proof system is highly experimental or its contracts are not thoroughly audited."
Step 2: Look at the "Risk Rosette" Radar Chart – Break Down Specific Risks
After you have a general impression of a project's stage, you can click into a project's page and examine the "risk flower." It uses red, yellow, and green to assess risk across five dimensions. Even projects at the same stage can show different risk levels in different dimensions.
| Risk Dimension | What does this dimension assess? | What does green (low risk) mean? | What does red (high risk) mean? |
|---|---|---|---|
| State Validation | How does the system guarantee the correctness of the L2 state? | A fully functional proof system (ZK or fraud proof) is used, and verification is permissionless. | No effective proof system exists, or the verification process is controlled by a centralized entity. |
| Data Availability | Where is the data needed to reconstruct the L2 state stored? | Data is posted on Ethereum mainnet (Rollup), with no additional trust assumptions required. | Data is posted off-chain (e.g., Validium), introducing trust in an external data availability committee. |
| Exit Window | How much time do you have to exit if you disagree with an upgrade? | Upgrades have a delay of at least 30 days, providing enough time to exit safely. | Contracts can be upgraded instantly, leaving users no exit window. |
| Proposer Failure | What happens if the entity responsible for submitting state (the Proposer) fails? | Anyone can permissionlessly take over state submission, or users can activate an escape hatch to exit. | The right to submit state is fully centralized and cannot be replaced; withdrawals will be frozen if the proposer fails. |
| Sequencer Failure | What if the entity responsible for ordering transactions (the Sequencer) goes down or censors you? | Users can independently force transaction inclusion via L1, or activate an escape hatch. | Users cannot independently push transactions on-chain and are at the mercy of the sequencer. |
Step 3: Pay Attention to Quantitative Data and Understand the Prevalence of Risk
Academic analysis of L2BEAT data also confirms the value of these risk frameworks. A study covering 129 L2 projects reports that:
86% of projects have a "no exit window" risk, meaning contract upgrades can happen instantly.
About 50% of projects have a "proposer failure" risk, potentially freezing withdrawals.
Among 32 recorded L2 incidents between 2022 and 2025, 59.4% were related to sequencer downtime or performance issues.
These figures show that many L2 projects still carry significant trust assumptions in specific areas—the risks are real.
How to verify your understanding
Pick two rollup projects you are familiar with (such as Arbitrum and Optimism) and check their Stages rating and each indicator of the Risk Rosette. Try to explain why a certain indicator is green or yellow, and whether that rating aligns with its stage. When you can clearly articulate the specific technical reason a project is marked yellow rather than red on a given risk dimension, you have learned how to use L2BEAT's tools to evaluate risk.
