Bridge Compromise

仕組み

A typical bridge locks an asset in a contract or custodial account on the source chain and mints a claim token on the destination chain, so the claim token is worth the underlying only while the lock holds and only while minting is restricted to genuine deposits. Two things can break. The verification can be defeated, as when a flaw lets a forged proof or an uninitialized verifier accept a message that no deposit backs, minting unbacked tokens out of nothing. Or the authority can be captured, as when the external validator set or multisig that signs withdrawals is compromised and simply signs the funds away. Bridges concentrate value from many chains behind one security model, which makes them a standing target.

実際に観測できるもの

Determine whether the bridge verifies the source chain with a light client and proofs or trusts an attestation committee, and if it is a committee, how many signers exist, what the threshold is, whether the signers are independent, and whether their keys are in separate custody. Compare the value held against that security model, and check for a timelock or a pause on withdrawal parameter changes. Every major bridge failure has a public post-mortem, and the incident history of the specific design is observable.

先例

In 2022 the Ronin bridge lost custody after attackers obtained control of a majority of the keys in its validator set, and the Wormhole bridge was drained through a signature verification flaw before its backer replaced the missing collateral.

重要性を左右する要因

Weigh whether verification is cryptographic or social, the signer count and threshold, how independent the signers are, how much value sits behind the design, and whether upgrades pass a timelock.