Next Gen Cross-Chain Bridges & How All Bridges Still Suck

Transcript

hey what's going on guys hopefully you enjoyed the comedy show before because I'm a programmer you don't want to hear my jokes okay okay why do all programmers need glasses because they can't see Sharp thank you thank you I'll be here all day um so welcome to my speech on the next generation of safer cross chain Bridges and why all bridges still suck so first a little bit about me my name is Daniel Lumi I'm a research and consultant working in l2's privacy um endows um so today we'll be talking about what is the current um designs for cross chain Bridges how do we improve those and make a next-gen

design um how are l2s better than any crosstain bridge and then steps we can take to improve essentially any kind of bridge so why this talk uh I'm actually in the ecosystem so I don't like Bridges that's like that should tell you a lot but um I do think we'll live in a world with many chains and if we do live in that world we definitely need better Bridges than we currently have and just to illustrate this like in 2022 of all of the hacks essentially 69 of the hacks accounted for bridge hacks and that was about two billion dollars lost in real capital and examples of this are the X Infinity Bridge The Nomad Bridge the Solana

Wormhole Bridge and here's sort of our current categories of bridges you don't have to look too closely at it yet we'll keep coming back to this the point of it is you have a spectrum of trust from trust the human to trust the code and within those categories we have two types of bridges one is wrapped asset Bridges the other is liquidity provider Bridges and again Raptor it's a spectrum of trust wrapped asset Bridges you have to trust forever for liquidity provider Bridges you have to trust while the money is in transport and so here's sort of our current generation of cross Chain Bridge designs we have custodial Bridges where one actor essentially chooses um what are the legitimate uh Crossing

transfers they custody the assets and they complete those uh we also have multi-sig where multiple parties come to an agreement on what is the canonical state or these legitimate transactions and then we also have optimistic fraud proof-based Bridges this is similar to like an optimistic L2 essentially all transactions are trusted to be true until someone's bought some fraud in there and they go through a challenge period on essentially proving that it's not a legitimate transaction so right now here's where we're at multi-sing and custodial as well as optimistic they Bridge funds cool um with optimistic Bridges you also kind of don't have to trust the state because

there's the fraud proof period the reality though is still multi-sig we'll get back to this so here's the next generation of cross Chain Bridge designs and these sort of break down into two one is a light climb Bridge which is native to the protocol and the other one is a ZK Bridge it gets very hot right now so CK everything and examples of like native like clients are IBC examples of like ZK bridges are for example ZK IBC which a lot of different projects are working on right now and just to get you excited on like clients big Satoshi actually had a whole section on like clients um in the white paper he didn't talk about bridging but

there was actually a section on like clients and so what is a light client so in a normal blockchain you essentially need to download the entire history of the blockchain re-execute every single transaction and then you know Daniel has one meet right with like clients you essentially just download the latest state and you can see okay Daniel now has one eth and he doesn't have to like you don't have to re-execute every single transaction before that and so how do like clients actually apply to Bridges right um so essentially again we can just check the latest state so instead of having to stick all of ethereum on Solana to have like a trustless bridges that wouldn't be trustless we can

essentially just submit the latest State Daniel Bridge one eighth to this bridge contract and wants it on well I would not want it on Solana but you get the point um so the first type of like client is native like clients right and some chains already supported like Cosmos chains um and essentially with this uh you have minimal trust assumptions outside of consensus right don't tell Cosmos people consensus is the whole trust assumption in bridges but a very good Bridge um essentially ethereum will also have like clients um with some like statelessness and vertical trees and actually making ethereum ZK on the base layer coming soon TM while talking 15 years

um zika like clients or zika Bridges or proof of consensus we like our acronyms in this space essentially our chain agnostic way of making a bridge ZK bridge for light climb bridge for any chain essentially you can make a ZK proof of the state of any other chain and submit it onto another one you do need to build it separately for every single type of VM and that's not great because these are complex circuits but it works with any type of protocol essentially um so here's the benefits of light climb Bridges essentially the user can force through a transaction so if the nodes or the the bridge multisig starts um censoring you you can actually push your

own transaction through and get it on the other side so you don't have to trust for that part you don't have to trust the relayers um also for like optimistic unlike optimistic multi-second custodian you don't really have to worry about the state truth because if someone's able to make a ZK proof they they can't lie like if they made it it's the truth that's a huge abstract so and we'll come back to that on the next one right and it is better latency than optimistic Bridges you don't have to wait three hours a week to send the funds so the problems with like climb Bridges is essentially you might have a ZK proof of one chain on the other chain right so now Solana knows the state of eth right

no because essentially you need to know which is the correct state of ethereum ethereum forks just naturally fairly regularly polygon Forks a lot regularly um or I could just like if I was a hacker I could literally just copy ethereum on my computer and double spend over and over again and be like I have a million eth and try to bridge that so the other chain needs to actually check what is the real state of ethereum right um you still have so that becomes an honest majority uh trust assumption you need a multi Sega on the other chain being like that's the real ethereum so it actually doesn't really solve anything it's a multi-sig bridge right um and essentially depending on the type

of like climb Bridge like this happened with Tara with IBC the relayers just kind of close down right so you couldn't actually push through funds from osmosis to Terra they just like nah not anymore so you just kind of got stuck right and the other issue with the ZK like client part is ZK is hard it's it's like magic math that's what I'm work in CK like there we will definitely be hacks just based on implementation so here's where we're at with Zeke and like climb Bridge the Next Generation we kind of don't have to trust the relayers there's kind of a state truth even if it's multi-sig for whatever that means it's it's

marketing ZK bridges are marketing essentially um and it Bridges assets cool but we have all these other issues that we need to fix so how do we fix those and again ZK is hard at this point optimistic is probably better than a ZK Bridge even if a bunch of Protocols are using it for marketing so how are l2s better like bridging within the L2 ecosystem and I call these the next next generation of cross chain Bridges get it because to L2 um and here's sort of our categories of multi-chain bridges not cross chain multi-chain is essentially a locally verified third-party L2 Bridge

and that's like honestly hop exchange is the only example of this maybe in the future Herodotus if you you still use like layer 0 or something from L2 to L2 it's it's multi-sig sorry like you there's very few bridges that fit in this then there's the native Bridges like ZK Sync has its own bridge to the protocol which is more trustless and then we also have this like you might have heard of these super chain or hyper chain of we're starting to have l3s and l4s and many l2s so that's called fractal ZK or super chain in the case of optimism but they'll also use DK so um yeah that's the it has to be locally

verified the third party Bridge most like Orbiter Finance is not a locally verified third-party Bridge so some people ask me like wait l2s are bridges Yeah by definition l2s are literally defined by the bridging contract on L1 that's all they are it's a bridge with a blockchain on top of it so here's examples of how multi-chain roll-up bridges are better than cross-chain Bridges so we have this concept of chain reords or attacks right we have to come to the consensus on which is in Bitcoin is the longest chain in ethereum there's a different protocol for actually choosing whose block to take right

and so what happens in our normal cross Chain Bridge Solana ethereum if either chain is reorged or maliciously attacked right so the wrapped assets like w eth on Solana become completely worthless right it's completely unbacked wreaks havoc on the ecosystem it's bad right and with Native assets like if you do let's say ethereum you swap it to Solana onto a different chain onto Solana the LPS might lose money and the important thing of this is like like you might think that it's only assets that are actually in transport at the moment that get attacked but it might actually become economically viable to forcefully reorg one layer over and over again and double

spend over and over again until you drain the entire Bridge so what happens uh if the L1 reorgs right and this is not a bridge this is L1 this is It's called probabilistic blockchains right if you swaps let's say East to usdc either you get your usdc or reorgs and you're back with your eth that's the Assumption we have for any blockchain right and so what happens um if the L2 rear if the L1 reords on the L2 right essentially the L2 users are fine again l2s are defined by their contract on L1 so if L1 reorgs essentially L2 reorgs right

um in any native assets you're like bridging from uh L1 to L2 are completely fine if the L2 reorgs essentially you're probably fine right but the reality is like if there's any third-party bridges that don't use L1 as a go between like like arbitrim to ZK sync if they don't send the message through L1 it's a cross Chain Bridge so again either the assets become unbacked or LPS lose money and the cool part of like l2s is you can actually trigger L1 trustlessly or L2 from L1 right and essentially uh this allows you to do completely trustless L1 to L2 message

passing or bridging because they all too can check the block hash op code and no it's the official version of ethereum the canonical version and you don't need any majority trust assumptions on that and you can also theoretically do trustless L2 to L2 bridging if it goes through L1 right no bridge is working on that it takes a long time it's expensive people like their money in seconds so if you are building a bridge on ltus please send it through L1 please for the sake of everyone let's not make cross-chain bridges in ethereum also and essentially well that's the same thing so some applications of this for

example is you can make storage proofs of the state of L2 onto a different L2 right and essentially like you can do like cross chain lending for example let's say you lock up funds on L2 you can essentially issue a loan on L1 without ever Bridging the assets actually through right or snapshot X like it's expensive to vote on chain so you can essentially vote on L2 and then trustlessly it can actually uh pass the state onto L1 and have trustless essentially voting so then we come to L2 plus Bridges l3s or these sort of like super chain concept l2s right and again

it's the next next next generation of uh safer cross-chain Bridges that looked better when it was just L3 that made sense because Three L's um doesn't make sense now optimism had to come and do super chains so now it's L2 plus um so the concept of super chain like the optimism version is essentially you have a bunch of l2s but they all use the same uh Bridge all the funds for all of those chains are defined by exactly the same contract right so when you bridge from let's say coinbase chain to optimism you're not actually bridging anything you're updating the value on L1 so it's essentially like accounting

rather than bridging right and essentially this allows you to natively bridge assets from one L2 to another one without extra security assumptions and using things like shared sequencers longer topic we can essentially also make that Atomic and sort of solve some of the blockchain scalability issues or user experience issue is of having a bunch of different chains also for ZK protocols we call this like recursive ZK or marketing hyper Bridges um and the idea is like you can build L3 L4 L5 on top of L2 and literally every single one of the fractals uses exactly the same circuit for bridging so as long

as the L2 circuit is safe all of the other layers are completely safe so you can go from like it's not showing like l14 to a completely random other L3 and one jump and you don't have to sort of come down or do any fancy bridging it's just accounting again you mark that it's not on this l14 it's somewhere else and so here's kind of where we're at with our L2 multi-chain World Bridges now we fix the weakest link problem essentially that means if any of these cross-chain Bridges actually get hacked any one of those chains gets hacked you can drain the funds of literally every single chain uh that's not true anymore

in L2 Roll-Ups um or super chain right we don't have wrapped asset issues or LP losses assuming you go through L1 there's no fragmented liquidity or cross chain Mev on the bridging Point um and you can do trusses L2 plus Bridges you can keep fracturing more and more into different chains without additional security assumptions so but then we still have these two issues like Bridge upgrades smart contract bugs issues with essentially implementing the verifier contract of ZK so how do we fix these so here's some steps that we can take to improve any kind of bridge whether it's

cross chain or multi-chain so first of all you should have a circuit breaker right if over 10 percent of uh your Bridges funds are bridged in a single day freeze the protocol and essentially that gives the team a day to figure out am I being exploited right this is basic some bridges do it you'd be surprised by how many bridges do not you should have essentially a delay period for upgrades because you might have a totally safe Bridge whether it's cross chain or um essentially multi-chain and then they upgrade it and they steal all the money right like it might have worked really well for a couple years and then they come in upgrade it and take all the money so if you do do a bridge upgrade

you should have a delay period of a week or 21 days that it goes into effect if it's a critical bug that someone can actually steal the money from and that's why you're upgrading you should freeze the bridge and then wait for the delay period and offer some sort of solution for people to claim their funds before that upgrade there's also this sort of on the prover level ZK provers again magic math right we're probably going to have issues with these so what you can essentially do is you can have like not just ZK proofs of the state onto L1 you can have ZK proofs plus Intel sgx that runs exactly the same transactions right and if one of them says that there's

fraudulent transactions it just freezes the protocol right and this way if intel shares the key or the the prover was implemented incorrectly essentially no one can still steal money there's also something togro's been working on called multi-verifier so you have the proof you have to verify it on L1 right what if you implement the verifier wrong right so you can essentially write it in two different languages and solidity and Viper and then hopefully if they're made by different teams if one of them breaks the other one can freeze the protocol because it sees this was an invalid transaction uh you can you should also have user Force transactions this does not work

with custodial Banks you're not going to be able to call coinbase and be like damn it move my money right it doesn't work with multi-sig Bridges it doesn't work with like clients but you can do this on optimistic or ZK Bridges cross chain or or multi-chain and you can definitely do this um on l2s l3s you can essentially allow the user to force transactions on their own if the sequencers are ignoring you and for any custodial assets right like usdc circles already the only person or the only party that can Mint or burn in the usdc right so you're already fully trusting them so at that point you should Implement a circle bridge and

they're actually working on this actually I think they published it so you don't have any additional trust assumptions moving usdc from eth to Solana because you're already trusting the protocol so might as well let them mint and burn that direction too and so now we've kind of fixed bridge upgrades a smart contract or proven verifier bugs but not really honestly we're never going to be able to fix these right code always has bugs like I don't think I've ever ridden a program in my life that didn't have 10 bugs in it this is normal right so we just need to build these sort of mechanisms to make it really hard to hack or if there is a bug how do we fix it without

putting the users at risk so the point of this whole speech is all bridges suck they're really bad don't use them thank you thank you just kidding um they do suck they always have extra security assumptions right let's not lie about this like layer 0 is not inventing a new form of trusted or trustlessness like let's just be honest let's try to improve these Bridges so users actually know the risk they're taking on and then we can slow slowly sort of improve these designs right please practice safe bridging you'll make metallic very happy the Clapping is wonderful you want to see a Mappy trust

me and for this actually this is a very trimmed down version there's like a 40-50 minute speech of this that I have that goes much more into details on all of these I still need to record it usually conferences have speeches of like 25 minutes so I'll put it online at some point you can follow me at zikaelumi I'll get it up also at uh starknet CC uh I have a new speech called scaling eth infinitely and how do we scale ethereum without essentially user experience and liquidity fragmentation long story short common Bridge shared sequencers come to Stark net CC maybe we solved the scaling trilemma

right we also talked a lot about ZK for many years it was a very small group of US map nerds that really love ZK no give a then zkebm came around now everyone's talking CK this CK that but the only people that know ZK are cryptographers right don't go ask a cryptographer how ZK Works they'll go into polynomial commitments and fried based recursion this is a mostly mathless way of explaining ZK uh also l2s have their own additional security assumptions it's not all roses this is a panel from Eve Gathering where we talked with different L2 teams on some of the security assumptions and how

we can improve them and then if you're gonna Bridge somewhere especially cross chain like you should do some due diligence and not just trust marketing L2 beat has a great um resource for this well Bridge risk analysis and you can visit it you can open up your Bridge projects and sort of read how they essentially they can rug you and that's it you can oops you can follow me at zika Lumi on Twitter um and I'll get all this stuff online as well so [Applause] time for questions

or comments saying that bridges are great so obviously you have to bridge between chains what is your number one Bridge stay on Eve I mean use native Bridges like it might suck withdrawing for seven days or don't Bridge much like you know how much money you're willing to lose so if you have a thousand in the bank maybe that safe limit is a hundred and then you can use hop exchange or something to move it and you won't be super depressed if you lose all your money um do you have an opinion on the end

style type of bridges uh where they would fall in your evaluation yeah so I'm actually very excited about the end we gotta explore them a little bit um and then we'll we'll update the speech and let you know one more no I guess we are good thank you cheers thanks guys have a nice day [Applause] [Music] [Music]

thank you [Music]