Bridge Compromise

运作方式

A typical bridge locks an asset in a contract or custodial account on the source chain and mints a claim token on the destination chain, so the claim token is worth the underlying only while the lock holds and only while minting is restricted to genuine deposits. Two things can break. The verification can be defeated, as when a flaw lets a forged proof or an uninitialized verifier accept a message that no deposit backs, minting unbacked tokens out of nothing. Or the authority can be captured, as when the external validator set or multisig that signs withdrawals is compromised and simply signs the funds away. Bridges concentrate value from many chains behind one security model, which makes them a standing target.

实际可观测的内容

Determine whether the bridge verifies the source chain with a light client and proofs or trusts an attestation committee, and if it is a committee, how many signers exist, what the threshold is, whether the signers are independent, and whether their keys are in separate custody. Compare the value held against that security model, and check for a timelock or a pause on withdrawal parameter changes. Every major bridge failure has a public post-mortem, and the incident history of the specific design is observable.

先例

In 2022 the Ronin bridge lost custody after attackers obtained control of a majority of the keys in its validator set, and the Wormhole bridge was drained through a signature verification flaw before its backer replaced the missing collateral.

哪些因素使其更重要或更不重要

Weigh whether verification is cryptographic or social, the signer count and threshold, how independent the signers are, how much value sits behind the design, and whether upgrades pass a timelock.