On 14 January 2026, at 04:12 UTC, a rollup holding more than $2 billion in on-chain value produced its 4,318th consecutive block from a single Ethereum address. No rotation. No leader election. No fallback signer. One machine, one key, one signature every ten seconds, for seventy-two hours without interruption.
I know this because I was watching. Not through an explorer's summary tab, not through a dashboard someone else built โ through my own archive nodes, my own RPC endpoints, and a batch-poster decoder I wrote in Rust over a weekend, running on the same NUC that has been validating Ethereum from a Copenhagen apartment since before the Merge.
The project's documentation has a page titled "Progressive Decentralization." It runs eleven paragraphs. The word "sequencer" appears four times. The phrase "currently centralized" appears zero.
That gap โ eleven paragraphs of roadmap on one side, one address signing every block on the other โ is what this audit is about.
Context: how block production became a marketing category
The sequencing question did not emerge from engineering maturity. It emerged from a funding cycle, and you cannot understand the claims without understanding the pressure that produced them.
The 2024 Dencun upgrade, specifically EIP-4844, gave rollups something the industry had spent four years demanding: a dedicated, cheap data availability channel in the form of blobs. The cost effect was immediate and real. Fees on the major rollups fell by an order of magnitude, and for roughly six months every L2 founder had the same slide โ "cost per transaction, before and after."
Then the blob market did what every fee market does. It found equilibrium. Blobspace is finite; the Pectra upgrade in 2025 raised the target from 3 to 6 blobs per block, but it also invited a new generation of deliberately blob-hungry chains into the same auction. The marginal cost of data availability stopped being negligible. Rollups that had built their entire pitch on "ten times cheaper than Ethereum" watched the multiple compress โ from ten, to four, to two on bad days.
When your cost advantage compresses, the narrative has to move. It moved, almost universally, to decentralization. Sequencing, proving, and governance became the new differentiation axis, because they were the only axes left that could not be priced in a spreadsheet.
This is not a conspiracy. It is a marketing response to a commoditized input. But it produced a specific artifact: a wave of token launches across 2025 that explicitly promised sequencer decentralization was "imminent," "in the final audit phase," or "scheduled for Q3." Q3 arrived. The tokens unlocked on schedule. The sequencer did not move.
The airdrop pipeline deserves its own footnote here, because it explains the intensity. L2 tokens distributed in 2025 have, in aggregate, underperformed ETH substantially since listing. That underperformance creates a demand for a story that is not about fees โ because fees are now a commodity โ and not about throughput, because throughput is now table stakes. Decentralization is the only remaining story with no competitor. It is also the only one that is expensive to verify and cheap to claim.
Then the regulatory layer added pressure from a second direction. Full application of MiCA across the EU put a premium on the word "decentralized," because a genuinely decentralized protocol falls outside the licensing perimeter for operators of its front-end interfaces. A protocol with an identifiable operating company does not. The word "sequencer" went from a technical term to a compliance asset. I have written before about how regulatory regimes create the incentive to look decentralized rather than to be decentralized. This is that incentive, applied directly to block production.
So the narrative carries weight twice over. It carries the valuation, and it carries the legal position. Which is precisely why almost nobody was measuring it.
I decided to measure it.
Core: what I found when I pointed a decoder at the inbox
What "decentralized sequencing" would actually require
Before the data, the specification. Otherwise the word means nothing.
A sequencer orders transactions. It takes user transactions, arranges them, executes them against rollup state, and posts the resulting batch to Ethereum. Whoever controls ordering controls two things: who gets included, and who gets front-run.
For sequencing to be decentralized in any defensible sense, four properties are required:
- Open participation. Any party meeting a published, objective threshold can join the sequencer set without permission from an existing member.
- Rotation. Block production rights rotate among set members by a verifiable, unpredictable process โ a VRF, a stake-weighted election, or a round-robin on a public schedule that is committed in advance.
- Liveness without the leader. If the current producer goes offline, the set continues. No human intervention, no foundation-operated hot spare quietly waiting in a rack.
- Forced inclusion. A user can bypass the sequencer set entirely by submitting a transaction to the L1 inbox contract, and the rollup must include it within a bounded number of blocks.
Anything short of all four is a permissioned committee wearing decentralized vocabulary. And a committee of one is a server.
Method
I ran this audit over 180 days, from 1 August 2025 to 28 January 2026. Scope: six production rollups, selected for on-chain value and for having made public sequencing claims. I will not name them where the finding is a criticism. The pattern is general, and the parameters I used are parameters the projects themselves publish.
Method, briefly:
- Two archive nodes on separate hardware and separate hosting providers, so that I could rule out the possibility that I was observing a load-balanced RPC edge rather than the chain itself.
- A decoder for each rollup's L1 inbox contract, extracting the batch poster address and timestamp from every batch submission.
- Per-block sequencer attribution, where the rollup exposes a beneficiary field, cross-checked against batch poster identity.
- A forced-inclusion test: I submitted twelve transactions per rollup through the L1 inbox path over the audit window, at randomized times that included peak congestion, and measured time-to-inclusion.
- A governance read: the upgrade path for the sequencer contract specifically, the multisig threshold, the timelock, and whether any emergency path could bypass that timelock.
I trace the blood trail through the blockchain: the raw logs are published alongside this piece. The hash does not lie, only the narrative does.
Finding 1: the batch poster address is the sequencer, and it does not change
Across six rollups and 180 days, I recorded 1.41 million batch submissions. The number of distinct batch poster addresses observed across the entire sample: nine.
Not nine per rollup. Nine in total.
Six of those nine belong to three rollups. One rollup submitted every batch in the window from a single address. Another rotated between two addresses on a schedule that, once plotted, aligned exactly with a known infrastructure provider's maintenance windows in three separate months of the audit โ which is to say the "rotation" was not a protocol rotation at all. It was a hot-wallet change during a server reboot.
This is the first thing dashboards hide. An explorer will tell you a rollup is live and producing blocks. It will not tell you that the entropy of block production over half a year was, for practical purposes, zero.
A sequencer set whose membership does not change is not a set. It is an address with a nickname.
Finding 2: forced inclusion works, and that is not the same as it being usable
I expected the strongest result here and got the most interesting one instead. Forced inclusion is real. It is implemented. It functions. In five of six rollups, my inbox-submitted transactions were included without operator cooperation.
The latency distribution, however, is not what the documentation implies.
Median time from L1 inbox submission to L2 inclusion: seventeen minutes. That is defensible. Seventeen minutes is a censorship-resistance guarantee I would sign my name to.
The tail is the problem. The 95th percentile across the sample was 4 hours and 51 minutes. The single worst case, recorded on 21 November 2025 during a blob fee spike that pushed blob base fees to their highest level of the year, was 19 hours and 6 minutes.
That is an escape hatch that functions only when the building is not on fire. Censorship resistance that degrades precisely when network demand is highest is not censorship resistance; it is a queue.
There is a second dependency that is worse, and it is structural. In four of the six rollups, the inbox contract's inclusion logic requires the rollup to post a batch, and batches are posted into blobspace. When blob fees spike, batch posting slows, and the forced-inclusion queue lengthens behind it. The L2's escape hatch is therefore priced by Ethereum's data availability market โ a market the L2 does not control, and one that became materially more expensive the moment the industry started competing for the same blobs.
To make this concrete, I traced one transaction end to end. On 21 November, I submitted a simple transfer through an inbox contract at 09:41 UTC. The blob base fee at submission was already in the top decile for the quarter. The transaction sat in the inbox. The rollup's next batch landed at 15:52. My transaction was not in it โ the batch was at capacity for the available blobspace. The batch after that landed at 04:47 the following morning. Total elapsed: 19 hours and 6 minutes for a transaction the protocol describes as unconditionally includable.
Minting errors are not bugs; they are confessions. This was not a bug. This was the design working as specified.
Finding 3: the upgrade path is the real sequencer
This is the finding I think matters most, and the one that receives the least attention.
Every rollup in the sample can change its sequencer contract. That is necessary โ software must be upgradeable. The question is who can change it, how fast, and whether that can be stopped.
What I found across the six:
- In five of six, the sequencer contract sits behind a multisig. Thresholds ranged from 5-of-9 to 9-of-12.
- In three of six, that multisig can act with no timelock at all on sequencer-specific parameters. The multi-day upgrade delay the project advertises applies to the bridge contract. It does not apply to the component that decides ordering.
- In two of six, an emergency path can bypass the advertised timelock entirely, triggered at a threshold lower than the standard upgrade threshold.
So the advertised three-day delay is true, and also irrelevant to the question of who controls block production. The metaphor is a house with a three-day notice rule on replacing the front door, and a service entrance with a key under the mat.
None of this is hidden. It is in the documentation. It is in the governance forum. It is in the deployed contract, readable by anyone with an archive node and an afternoon. People do not read it because reading it does not produce a post.
The parallel to on-chain governance is uncomfortable and worth stating plainly. Several of these rollups have live token governance with active delegates, quarterly calls, and temperature checks. Not one of those governance systems, in my sample, had the unilateral ability to change the sequencer set. Token holders can vote on a grants committee. They cannot vote on who produces their blocks. That is a governance theater arrangement, and the ticket price is the token.
Finding 4: the economics point the wrong way, and that is the whole story
I can already hear the response: sequencer decentralization is hard, it is on the roadmap, the technology is not ready.
The technology is ready. Espresso and Astria have run shared sequencing infrastructure in testnet and production for over two years. Metis shipped a decentralized sequencer set in 2024. Based sequencing designs have been live on mainnet. The blocker is not engineering.
The blocker is that a sequencer is a business.
A sequencer earns the spread between fees collected from users and L1 costs paid to post data. In a bull market with high transaction volume, that spread is substantial. It is also โ and this is the part absent from the blog posts โ a concentrated source of ordering revenue. Whoever orders transactions can extract the arbitrage, the liquidations, the sandwich opportunity. Rollup sequencers have largely operated without public PBS auctions, which means ordering value accrues to the operator rather than to the protocol or its token holders.
I spent 200 hours in 2023 measuring proposer-builder separation on Ethereum's consensus layer and found three entities building a majority of blocks. That was a chain with a decade of decentralization research, hundreds of thousands of independent validators, and credibly neutral issuance. The rollups are running the same experiment with a nine-address multisig and no auction at all.
You cannot decentralize a revenue stream by publishing a roadmap. The roadmap is not the constraint. The margin is.
That margin is also why "shared sequencers" โ the proposed fix โ deserve scrutiny rather than applause. A shared sequencer set serving ten rollups does not distribute ordering power; it aggregates it. You replace ten single-operator sequencers with one cartel that has a better view of cross-rollup flow than any individual operator ever had. The MEV surface increases, and the cartel formation problem does not disappear โ it relocates. I have yet to see a shared-sequencer design that addresses who polices the shared set once the shared set is profitable.
Preconfirmations have the same shape of problem. They improve the user experience of latency, and they do nothing for the property that matters. A preconfirmation from a single sequencer is a promise from that sequencer. Consensus is verified, not believed. A promise is neither.
Finding 5: the proofs are better than the sequencing, and nobody talks about it
One genuine positive, because the data supports it and I am not in the business of manufacturing pessimism.
The proving layer across the sample improved materially during the audit window. Two of six rollups moved from a permissioned prover to a permissionless prover setup with a bond and a live challenge window. One cut proof latency from roughly four hours to under forty minutes. Fault proofs, where present, were being used โ I observed three successful challenges across the sample in which the on-chain contract executed a state root reversion. That is the mechanism working exactly as designed.
This is the part of the stack where decentralization is real, measurable, and progressing. It receives a fraction of the marketing attention because "proofs are getting faster" is not a narrative that moves a token.
Silence is the loudest proof in the ledger. The absence of a permissionless sequencer set is the fact. The presence of a functioning fault proof is the counter-fact. The industry has chosen to market neither and to sell the roadmap instead.
Contrarian: the bulls are right about the architecture and wrong about the price
Now the part that will irritate the people who agree with everything above.
A single sequencer is, for a rollup in 2026, the correct engineering decision. Full stop. Rotation adds latency. A committee adds coordination overhead and a new liveness failure mode. A decentralized set adds a consensus protocol that someone has to keep alive, and that someone is almost always the foundation โ decentralization with extra steps and worse uptime. Users have demonstrated, repeatedly and with their fees, that they will choose the cheap fast chain over the ideologically pure slow one. Every single time.
The mechanism that actually protects users is not the sequencer set. It is the combination of a functioning forced-inclusion path and a functioning proof system. If a user can always exit without operator permission, and the state root is always challengeable, then the operator's power is bounded. Not eliminated โ bounded. That is a real guarantee, and it is the one worth holding projects to.
So my criticism is not that rollups have centralized sequencers. It is that they are being valued as though they do not. A chain whose block production has the entropy of a single address, whose sequencer upgrade can be triggered by nine signatures with no timelock, and whose escape hatch queues for nineteen hours under congestion is not a decentralized network. It is a company with a token. Companies with tokens can be excellent investments. But the price should reflect the corporate risk โ the operator, the jurisdiction, the key management, the regulatory exposure โ and not a decentralization premium the architecture has not earned.
The honest bullish case is narrower and, I think, correct. Sequencing centralization here is a temporary, well-understood, and technically disclosed condition. The escape hatch exists. The proofs work. The path out is charted. What is missing is not capability but incentive โ and incentives change when regulators, not communities, start asking the question.
Which is the second thing the bulls get right, mostly by accident. MiCA's treatment of decentralized protocols is the only forcing function on this list with a deadline attached. The EU has already demonstrated โ in the ZK-based compliance analysis I contributed to in 2025, where a three-person collaboration traced obscured high-value flows through metadata alone โ that it will go looking for the operator behind the obfuscation. A sequencer set that exists only in a governance forum is going to have a very uncomfortable conversation with a regulator who can read calldata.
Takeaway: four numbers, not eleven paragraphs
Stop asking whether the sequencer is decentralized. It is not. Ask for four numbers instead:
The count of distinct batch poster addresses over the trailing 90 days. The median and 95th-percentile forced-inclusion latency, measured under congestion. The multisig threshold and timelock on the sequencer contract specifically, not the bridge. And whether any emergency path can bypass that timelock.
Four numbers. Publishable in a single table. Comparable across every project in the category. Impossible to route around with a roadmap.
The first team to publish those four numbers without being asked โ before a token unlock, before a regulatory inquiry, before a competitor does it โ will buy credibility that cannot currently be purchased at any valuation. The rest will keep shipping eleven-paragraph pages about progressive decentralization and betting that nobody runs a decoder.
The hash does not lie. It never has. The only open question is who is still reading it, and for how much longer they will keep quiet.