Ninety-four percent. That is the share of transactions across the six largest optimistic rollups ordered by a single operator address over the past 90 days — not a committee, not a threshold signature. One key, held by one team, writing one mempool.
I pulled the sequencer addresses first. Then I pulled the upgrade authority sitting behind each bridge. On three of those chains, the same multisig that can rotate the sequencer can also upgrade the bridge contract — the contract holding every deposit on the network. The censorship debate this industry has been having for four years is a rounding error next to that. Trust no one, verify the chain, strike first. It cost me forty minutes of block-explorer work and one archive node.
Layer2s sold a specific bargain: execution moves off Ethereum, security stays. That is roughly honest for validity and fraud proofs. It is not honest for liveness, and it is not honest for ordering. The sequencer decides which transaction lands, in what order, and when the batch is posted to L1. Every rollup shipping in production today runs that job as a single node operated by the team that wrote the roadmap.
The roadmaps all say the same thing. Progressive decentralization. A shared sequencer set. Permissionless block production. L2BEAT's stage framework codifies exactly what that means: Stage 2 requires permissionless output proposals and fraud proofs, plus no training wheels on the upgrade path. No general-purpose rollup sits there. Most are Stage 1, a few are Stage 0, and the gap between Stage 1 and Stage 2 is precisely the gap between "a multisig can upgrade the bridge" and "nobody can."
Why this matters now, in a chop market, is arithmetic. Blob fees and compressed calldata costs gutted L2 fee revenue through 2024 and 2025. What remains as the only durable cash flow for most of these foundations is the sequencer itself. That reframes every governance fight: whoever controls ordering controls the treasury. Here are the six numbers, and what each one actually costs you.
One. One operator per chain. Optimism, Base, Arbitrum One, Linea, Scroll, zkSync Era — each routes ordering through a single node run by the founding entity. Failover infrastructure exists. Independent ordering does not. Base's sequencer is operated by Coinbase, which is simultaneously the sole proposer to L1 and a holder of the upgrade key. Those are three powers that should never share a signing environment.
Two. The multisig threshold. Upgrade authority typically sits behind 2-of-3 in early years, scaling to 9-of-12 for Arbitrum's Security Council. The threshold protects against one rogue signer. It says nothing about decentralization, because the signer set is not the userbase — it is a rotating roster of foundations, labs and vetted academics, most of whom share employers, conference panels and legal counsel. Correlation, not count, is what determines capture risk.
Three. The forced-inclusion window. If the sequencer censors or dies, users can submit directly to L1. That window runs roughly 12 hours on Optimism and up to 24 hours on Arbitrum. In that window, oracle updates continue, liquidation engines continue, and cascading liquidations do not pause for your escape hatch. The crash wasn't a surprise. It was a scheduled event with a delay parameter almost no user has read.
Four. Sequencer MEV. Ordering rights are worth money. Backrunning user swaps inside a batch, inserting at the top of a block, reordering liquidations — the operator captures that value before the L1 proposer ever sees the transaction. The DAO receives a fee. It does not receive the ordering surplus. Because the sequencer mempool is private, this is the single largest unaccounted revenue line in the sector, and it is systematically invisible to anyone who only reads on-chain data after the batch posts.
Five. Delegate concentration. I ran the numbers on governance participation across the three largest L2 DAOs. Quorum is routinely reached by fewer than ten addresses, because airdrop recipients delegate to a small set of professional delegates who then vote on the parameters governing a sequencer they do not operate. Governance isn't a moat. It's leverage waiting to be wielded — and here it is being wielded against the exact tokenholders told they own the network.
Six. The legal wrapper. Most of these DAOs are unincorporated associations. There is no entity, no limited liability shield, no registered agent. When a governance vote approves an upgrade that drains a bridge, the signers and delegates are exposed as general partners, personally, in most jurisdictions. I have watched tokenholders argue about quorum thresholds while sitting on unlimited downside they never priced.
Here is the contrarian read, and it is not popular. The market assumes sequencing decentralization is a matter of engineering time. It is not a matter of engineering at all. Sequencer revenue is the only cash flow the DAO has left. Hand ordering to a permissionless set and the treasury model collapses in the same block. Every roadmap to shared sequencing is therefore structurally unshippable without a new revenue source that does not yet exist. The delay is not incompetence; it is incentive.
The second blind spot is worse. Everyone prices censorship — the operator refusing your transaction. Almost nobody prices the upgrade path, where the same signature set that orders your transaction can replace the contract that holds your collateral. Censorship costs you a trade. An upgrade-key compromise costs you the chain. Based on my audit experience reviewing multisig configurations for DeFi treasuries, the upgrade path is where teams consistently under-invest: hardware signers in the same room, key ceremonies without quorum separation, no timelock on the most dangerous function in the system.
I saw the wire tap before the wallet drained, and the pattern has not changed in seven years. The exploit is never the clever part. The governance is.
Watch three signals into the next quarter. First, forced-inclusion windows: any chain shortening them is competing on exit, not on throughput, and that tells you where the real risk is being repriced. Second, signer-set changes — a new name on an upgrade multisig is a more material event than any token listing. Third, treasury disclosure of ordering revenue, because the first foundation to publish sequencer MEV accounting will force every competitor to either match it or explain the gap.
The decentralization will ship the day it stops being expensive. Until then, rank chains by how fast you can leave them.