# Isn't the security of EC curve 25519 126 bits?

The security of the EC25519 is given as 128 bits, but since the order of the group is 252 bits shouldn't the security be 126 bits? Given as half the magnitude of the underlying field, since DLP algorithms such as Baby-Step-Giant-Step and Pollard-Rho generally have a complexity of O(sqrt(n)), n being the order of group. At least in theoretical terms. What am I missing?

If look at safecurves's rho page you can see the rho complexity for curve25519 is $2^{125.8}$ in accordance to what you say.