Cross-Chain Bridges Uncovered: From Centralized to ZK | ETHDenver 2023

so actually my name is Casper this is the work I've been uh I've been doing uh with Alex anyway all good we will talk about cross-chain bridges here so uh just to establish what we are talking about a bridge is a system that kind of helps you to move assets from one chain to another one and the way it works is that assets they get locked on the on one chain and then you issue a dead token on another chain now if you want to withdraw your initial funds then you burn tokens on the Chain where the tokens were minted and then uh the day your original tokens they get released so there are uh three parts to this system there is a smart contract on the original chain then there is a contract on on the target chain and there is the communicator that uh exchanges information between the two chains so we looked at the design space of cross chain Bridges and we categorize them across two Dimensions the first one is the degree of decentralization and the second one is the settlement speed so originally people worked on the standard centralized Bridges where you typically wait seven days before the funds get get released and the communicator itself is a central party uh Boba introduced fast centralized Bridges where they have liquidity pools where the operators they take the risk on themselves but they allow you to exchange the funds uh much much quicker than with the standard Bridges the recent advancement are ZK Bridges which do not require a centralized party as a communicator but they are completely trustless I think this is a really really cool advancement and uh over like even if you use UK Bridges you can imagine that there may be standard Bridges where you still have to wait sometime before releasing the funds and there may be fast Bridges with liquidity pools so how would a ZK Bridge work so the idea is that you can have two chains let's say chain a and chain D and chain B would have a light client that synchronizes the state from the chain a so you could always prove that you have the funds uh on chain B and that's reflected uh on the other chain you could also Imagine going the opposite way where the state of chain B is reflected on the state of chain a this would allow you to have a cross Chain Bridge between these two chain and this cross Chain Bridge could be completely trustless one important thing is to keep track of the Forex because you never know when uh chain reorganization may occur so let's look a bit closer at uh Forex so uh a good example is a recent Fork on ethereum where we went from proof of work to proof of stake and proof of work and if you run a bridge from ethereum to somewhere else the bridge would have to pick one of those Forks now what's the impact on performance in security when we have Forex typically actually there is no impact besides what the source chain promises in terms of performance and security the situation gets much more interesting when we have Channel reorganizations called the reorgs so a reorg is a change of the tip during Bridge operations because the bridge has to pick one of the those forks and that may need to be reflected on the uh on the target chain may occur organically or they may be caused by by an attack and they may impact the state of the target chain and the debt is sure and this attack is quite realistic so and I looked at the recent numbers so even one hour over 51 attack according to crypto 51 is about 1 million dollars so how would this work let's say we have a tip B2 and then I'm running this 51 attack let's imagine that I'm the attacker and I'm making a deposit on the legitimate chain and I uh Bridge my funds onto the other chain cool they are there now if I want to withdraw my funds look what happens on the legitimate chain they uh this is reflected on the Block before but I also reflect this on my 51 51 chain where there was no deposit so without any protection I can steal funds from the bridge this way as long as I can build more more blogs and people can build uh on top of it so when we want to look at the rears besides the two Dimensions we think uh we also need to look at the third dimension which reflects the state reversion so if we go between two L1 chains and there is a reorg you cannot revert the state of the other L1 chain right but if you go between L1 and L2 you could revert the state of L2 because L2 is secured by by the given L1 so let's look at reworks from this perspective so our assessment in terms of performance is the following for fast Bridges there is a medium impact on the performance because it is dictated by the by the frequency of those reorgs whereas on standard Bridges there is low impact as long as the number of confirmations uh is higher than the the than the frequency of the reorgs the situation gets much more interesting when we look at the security aspect if you have L1 to L1 Bridges and there is a reorg on the source bridge then you effectively can steal the funds and there is no way to go back with that operation with fast L1 and L2 Bridges we believe the impact is high but there may be a way to prevent double spending when it comes to standard Bridges our assessment is that the impact is medium because as long as you have more confirmations that go uh beyond the reorg then you should be okay but let's look a little bit closer uh at the L1 to L2 Bridges because clearly there is a difference between L1 to L1 and L1 to L2 so here is one solution how you could prevent double spending on those L1 to L2 Bridges and I'm going to go over it a bit slow because uh besides just doing the deposit you uh you'd like to do a hash of that deposit but also you would like to know the sum of the all of the previous deposits also the the tip of the chain and chain ID and let's say we have this information and I launch attack on this uh on on this chain then I Bridge my funds to uh to my target chain and now imagine I want to withdraw my funds so in the first situation on the legitimate chain uh oh sorry I forgot to mention that the the key the key piece is here that the bridge keeps track of the mo the hash of the most recent deposit so uh the bridge has this information and when I withdraw the funds I need to reference this uh most recent hash now when I withdraw the funds to this blog before everything checks out because the the hash H okay is included in the previous block and that would be verified by the smart contract that unlocks the tokens now look at what happens at this 51 attack chain uh we're not I still have the same smart contract that verifies the hash but the hash from the original deposit is not there so the uh this withdrawal will fail so by using this mechanism we can uh we can protect uh those uh legitimate withdrawals when uh in the presence of a chain reorgs so uh with this mitigation uh still uh we still have a problem with l1s to l1s but l1s to l2s uh are okay because we mitigated uh the you know the possibility of stealing funds uh when we go back to the original chain and note that this works both for fast Bridges and for slow Bridges so uh here are a few conclusions that I'd like to to uh leave you with I think they are most probably most useful for uh Bridge Builders so the design space of cross chain Bridges is growing and it's pretty exciting I think that especially the translate ZK bridges are really cool because you eliminate the only centralized party uh in uh in the in the cross Chain Bridge projects I believe it is a significant advancement in our assessment overall uh reorgs have much higher impact on security and performance than the Forex and also security uh seems like a much more complex issue than than performance when it comes to cross-chained Bridges but but the impact of reorgs was independent of decentralization so uh what what was important was whether uh we are talking about L1 to L2 or L1 to L1 Bridges clearly fast L1 to L1 bridges are a no-go in the presence of reorgs because you can and you can end up stealing the funds now the presented mitigation strategy is applicable to any L1 to L2 Bridges and it doesn't really depend whether we have centralized or decentralized Bridges and finally the different kind of bridges they can be mixed so you may have one type of bridge for the off-ramp and another type of bridge uh for uh for one for the on-ramp and one for the off-ramp so uh without an uh this is with that I'd like to finish my presentation thank you very much uh for your attention my name is Casper we have a booth over there uh and if you want to talk about security or audits uh I'll be there after this presentation thank you very much