Ethereum Foundation DevCon 6 - Layer 2s Track, 14 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Rollups Are the Most Secure Bridges by Bartek Kiepuszewski | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/rollups-are-the-most-secure-bridges/

l2beat.com has established itself as the most trusted community resource assessing security assumptions of different Ethereum scaling solutions. Each such solution has a "native" bridge allowing users to move tokens to L2, but there is a plethora of other bridges available to end users. How do they compare to "native" bridges ? What risks users face sending tokens across these bridges ?

Speaker(s): Bartek Kiepuszewski
Skill level: Intermediate
Track: Layer 2s
Keywords: bridges,l2beat,rollups,multichain

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Obviously, and I'm gonna talk a little bit about bridges. You might have heard a lot of talks about bridges. This one might be slightly different because.

A

The subject of the talk is actually quite serious: I mean we had a lot of problems with Bridges recently, so um before I actually go into the um the Crux of the matter. Let's, let's just go back uh and look at a bit of a history.

A

So how come I'm here, two years ago, more or less, we started to work at the uh multi-train strategy for the maker Dao and we ask ourselves a question: how do we actually move the eye to different chains, so um it was actually quite quite hard and and for us, let me go back so two years ago we started to work on the multi-train strategy and we had to look at all the other chains and we had to find out how secure they are to actually be able to move die in a very secure Manner and to do that to look at the security of all the other chains.

A

So basically, I created the spreadsheet and I posted the spreadsheet, on the Forum and frankly, after a while. Not a lot of people looked at the data and looked at what we had to say so so I figured that we need to make this information more broadly available to the broader audience and we basically created a website called L2 beats and the reason for us to actually do that was to make people aware that security of the eye on all the other chains is very, very different.

A

If you hold the I on, let's say polygon, if you hold die on Phantom you'll be looking at a very, very different die and the security properties of the die will be very different for make it out. It is of the utmost importance. The Dai is censorship resistance and if you hold the eye on all these other chains, you should really ask yourself a question: is this really a die that you hold on ethereum?

A

Does it have the same Properties or is it actually different right, and can you make all these different dyes fungible and what is what is it really needed to be able to maintain all these other chains, so these are actually quite hard questions and that's why it took us so long to get all of us to where we are here and um once we looked at all the other chains. We want to publish all the results, and this is how l2b was born ldp.

A

It was essentially initially created as a website to disclose all the risks for all the different chains and.

A

It took us really by surprise how important this thing was. Everyone was like really looking at at the risks and the value locked and at all the information that we actually uncovered in a way.

A

So let's have a very quick look at the state of the bridges and where we are today so essentially uh when we look back at the last year, it was about a year right. We had a hack at the poly Network. We had a hack at the chain, swap we had a hack at the uh any Swope. So uh last year was really very bad, but that doesn't really compare to what we witnessed this year and it's really shaping up to be much much worse.

A

So it all started with the Wormhole hack. Then we had a running Network. um It was like huge 600 million dollars uh was taken from that bridge. uh Then we had the harmony um Nomad. This one was particularly bad uh I personally really liked Nomad architecture. I was actually trying to convince my peers at maker to have a very closer, uh much closer, look and, unfortunately, to a bug in a smart contract.

A

It was hacked uh literally two weeks after I pitched uh Nomad, so that was that was really really uh intense and and then probably a week before Defcon you might have heard about binance and I even had to correct my presentation because of what happened literally yesterday right, it's not just the bridge. Some other D5 protocols were hacked as well, but yet we had another Bridge hack. So bridges are scary and bridges seem to be really a weak point in all of this and we had to take a closer look at all of them.

A

So far, we've spent the last two years, looking mostly at the Roll-Ups, and now it was time for our team to have a look at other Bridges as well and how we publish this information.

A

Like I said before we basically looked at all the escrows, we looked at all the values that was locked in all the bridges, but looking at other, not just the Roll-Ups looking at other Bridges was essentially requested by the community and if Josh Stark from ethereum Foundation asks you to actually do something, you should certainly consider so without the further Ado I mean.

A

This is actually my pleasure to uh to announce that at l2beat we also are covering all the bridges uh you can check it out, it's actually up and running and live uh since yesterday and I'm gonna tell you a little bit how we look at these Bridges and what are the funding findings that we uh uncovered uh by by looking at these Bridges?

A

So to put it simply, we obviously track total value locked in these Bridges, so we can see more or less the same type of list. As for layer twos, uh we tracked total value locked and uh you can. You can see how much value is at stake. uh This is all that value that potentially can be hacked, and the bridges are like these uh huge pinatas uh for uh for potential hackers right.

A

So we really need to understand what are the risks and what are the security assumptions behind all these Bridges and then you can look at the bridges to roll ups uh as a type of a canonical Bridge. So you can combine this information and- and you can see the total value logged in uh all of these systems and all of these Bridges.

A

uh But, as you know, uh l2b is primarily about the uh the risks we want to disclose. The risks uh like you can see. On this particular example. uh Most of you probably know that optimism does not have fraud, proofs uh right now deployed and this information should be known and available to everybody. So you know when you move your funds to optimism. What are the security assumptions? I mean we are in a close contact with Optimist team.

A

We know that they're working on the fraud proof system, but as it stands right now, you have to trust them right. You have to trust the team and you have to trust the sequencer.

A

um So I guess we thought that you know we need the proper uh risk framework for Bridges. uh That would work more or less the same way as we did that before for uh Roll-Ups. We believe that risks should be disclosed. We believe that we should make everybody aware of the underlying security assumptions. uh We should constantly monitor infrastructure for upgrades and we should really monitor the uh the security uh parameters, and this is tough. This is hard because some of these constructs are actually quite quite complex and you need proper automation.

A

You need proper, tooling. You actually need to be able to read from Storage diffs which, if you have ever tried to do that, it's not particularly easy and thankfully right now there are some tools that actually allow you to do that much easier, but generally what you need to do is you need to replay all the potential ethereum transactions that change the particular slot, so so that stuff.

A

But but this is our task, and we believe that once we do that, we'll actually make multi-train infrastructure more transparent and secure, while keeping teams honest- and it is all about honesty right. It is all about proper disclosures. It is all about making sure that users do understand the risks. So what are the risks when you're actually using Bridges, and you would be surprised how a few people actually do understand most people kind of think that when funds are in transit and once they arrive to the destination, they should be safe right.

A

So it's almost like you know, Crossing the the bridge across the water and and once you've made it to the other side. You know you're safe, but you're, not you're. Definitely not safe and I will try to explain why, but before I do that you know I will actually share with you uh interesting findings that you might actually also find surprising.

A

So so the first one and I think it's actually quite a big one uh is the uh the multi-chain multi-chain is one of the biggest Bridges with the biggest dvl turns out that last year they actually removed from escrow uh quite a lot of funds like literally millions of dollars, so normally for that type of bridge.

A

You expect that you put your funds into the escrow and, on the other side of the bridge, some funds will be minted right and when you go back uh the funds from the destination they will be burned and the validators will release the funds from the escrow turns out that you know in this particular case, validators actually took funds out of the escrow without actually burning them from destination.

A

So that was odd and the the amount was very significant and it seems like no one cared like people were not really aware that that was happening and just the fact that it is possible for the validators to take funds out of the escrow. uh This is the risk assumption that you know you should be all aware of right if you're using the bridge. That's externally validated, that's the thing you know they can all take your funds.

A

So in this particular instance, apparently the funds were used to provide liquidity uh to any tokens on on a lot of different chains and to make sure that this is exactly what happened. You would have to like go to all the other chains and check it out, but you know my question to uh to the multi-chain team is: uh was this part of the contract right uh worry users aware and what is the consequence? Can actually users withdraw all their funds and, more importantly, uh what is this additional trust assumption?

A

uh Because it validators can remove funds from the escrow? uh They can do all sorts of things as well right, and how do you actually monitor uh what they're doing so this one? Then you have something called plasma Bridge. uh Some of you again might be aware of, because this is uh one of the two Bridges uh that you normally use to move tokens to polygon and this particular one has a very interesting documentation.

A

It says in the documentation that it provides increased security grantees because there's a seven day withdrawal period, and during that period you can challenge uh um validators from polygons. So it's kind of like a plasma exit mechanism.

A

However, the best of my knowledge, uh this was actually implemented and deployed on a test net, but it was never deployed in a mainnet right. So if you look at the mainnet code and by the way, who's looking at the main code of the bridge, you know the contract. Probably very very few of you you'll see that the method that allows you to actually challenge the validate. This is empty right.

A

You can't do that so frankly, the plasma bridge right now has the same security assumptions as the POS Bridge, the main bridge that you normally use the polygon, and it's got this user nuisance of seven day withdrawal period and the last one that I wanted to mention uh which, in the documentation uh the risks were properly disclosed but again I think that the user should be aware of that. If you use the Omni bridge to move your funds to the X di chain, they might invest some of these funds.

A

They might actually put the funds that you normally expect to be in the escrow into other into compound or whatever they like. Actually right. So normally it's called re-hypothetication This is the practice where you know. Banks are using your funds to actually invest them and you're running into liquidity risk. Potentially, if you were to withdraw all the funds it uh they may not be available, they might be like locked somewhere in in sayava or whatnot right, so the whole process is very transparent, but the power of value data is to actually do.

A

That may be surprising. To some of you because again is a question: uh what are the security assumptions right and what do you normally expect when you put the funds into the bridge?

A

So uh so now, with all these examples, you may wonder you know how do you actually collate all this information and how do you actually make it available to the users, and this is a challenge- we've got hundreds of bridges, we've got hundreds of different destinations, we've got hundreds of tokens and every single transfer may be actually different right, and this is a challenge for us as well, because we really wanted to make it very transparent to everybody, and we wanted to make sure that users are actually aware what exactly is happening behind the scenes.

A

So so we try to kind of you know, make it the whole framework. User, friendly and I will quickly uh summarize what you will be seeing uh on the L2 beat Bridges section. So, first of all, we kind of differentiate primarily to different Bridge types and the first one is a token bridge and that's the bridge. That means tokens on the destination and then so. This is something that you know. Normally, you should be like intuitively expecting right. You put tokens into the escrow, the Bridgeman's tokens on the destination.

A

However, a lot of bridges cannot mince tokens right like take die. As an example, I mean most bridges won't have uh access to diamonding facilities, so they have to do something different uh they have to on the destination. They have to create a liquidity pool. They have to Mint something- or maybe you know through some other mechanism, and they will like swap whether they minted for the die. That is like sitting and waiting for you on the destination, and we call these types of bridges, liquidity, Networks and I.

A

Think what is the most confusing for end users is that if you go to a UI of almost any Bridge, you will not know if you're actually using token Bridge or a liquidity Network. In fact, uh some of the bridges are hybrid, sometimes for some tokens they may actually mint you tokens. Sometimes they may use uh liquidity poles and it like I, see the case for the multi-chain. You can have like some mixed results.

A

Some of the tokens may be minted for you and some of the tokens may be actually uh coming from the liquidity Pawn. So these types of bridges we will call a hybrid and again, if you compare token Bridges to liquidity networks, they have a very different risk profiles.

A

um So, for the end, users I think it's very useful to actually understand uh the difference between the two right. You have unlimited liquidity for the token Bridge, uh you have tokens uh that if you keep the token at the destination, you will face the risk of the validators of that bridge and generally token Bridges can be quite slow and expensive. While the liquidity network is almost like the opposite right, it has a limited liquidity.

A

Typically, so you might end up with your tokens being stuck, uh but tokens held on the destination are not at risk of this network they're, actually at risk of the token bridge that was used initially to move tokens to the liquidity pool. So again, this is the risk, that's actually quite difficult to uh disclose and finally, they can be fast and they can be cheap right.

A

So so this is the uh the column on the L2 beat, which you can check very quickly and- and this is something that should be essentially easy to read for all of you and if you use any particular type of a bridge, you know I, do encourage you to check it out and and and and and understand the consequences.

A

More importantly, from the risk perspective- and this is like maybe a little bit more technical- uh is the question- how the messages are actually relayed between the source chain and the destination chain. So technically we use all sorts of uh terms for this like arbitrary messaging, Bridge or some other terminology, but because we wanted to make the framework sort of user friendly.

A

We just want you to understand what are the four, in our opinion, primary mechanisms that are actually used to relate the messages and again these messages are important, because when you lock your token at the source, the destination somehow has to be informed. How do you mean the token of the destination right? So what are the four different categories? Well, first of all, you've got the third party, meaning that you have to trust someone to relay this message and that particular party can essentially break you right. So you you put full Trust on that party.

A

Then you've got what we call the optimistic scheme. We relay the message. We trust that the message is correct. Unless someone actually proves that the message is incorrect, so your intuition should be like who's watching uh the relayers right who are the Watchers and what is the length of the uh of the fraud proof window because optimistic uh message? Bridges, they always have watchers and they always have the uh fruit fraud proof window.

A

Then we've got bridges that we normally call as secured by light clients, and essentially what it means is that we trust the destination chain to tell us what happened right. So when, let's say polygon, validators say that something happened on polygon I. Don't check that this is exactly what happens.

A

I just trust the polygon validate this and on ethereum I just need to build a software that will check the signatures, essentially right so you're, putting your trust on the validators on the destination chain and the more secure bridges in our opinion are the trusted bridges that use ethereum as the ultimate source of Truth. So we don't trust anybody. We build smart contracts on ethereum that will validate if the destination chain is not lying to us.

A

Obviously, there are two techniques right now you can use ZK proofs or you can use uh fraud proofs, that's why we've got zika Roll-Ups and optimistic rollups and, if implemented correctly, these are by far the most secure Bridges, provided that there are no bugs in the implementation right.

A

So uh what can go wrong? I mean you forgot, the external validators. Everything can go wrong right. They've got full access to the escrow, they can mint whatever they want to Mint. If there's a bug, you know you can have billions of tokens minted out of thin air and validated this can censor, they can steal, they can freeze funds, they can do whatever right.

A

You have to fully trust validate this for optimistic validation, as I said before, you need to make sure that Watchers are actually active, because if no one's watching uh the fraudulent message can be relayed for the light client validation. uh If you're transferring your tokens to a chain, that's weak that has very I, don't know it's a low value chain and vital this can be potentially 51 attacked. Then your tokens again can be stolen from escrow.

A

So you have to really understand how strong is the chain and that you're moving your tokens to and finally for roll-ups for a full client, ethereum validation in theory. Nothing can go wrong right, so funds cannot be censored. Funds cannot be stolen as long as there are no bugs in the implementation, and this is the uh how we actually show uh who is validating all these Bridges and I think this is the most important column that you should all Focus.

A

If you want to understand uh how a particular Bridge operates, then we have the upgradability uh so so this is essentially the information whether the bridge can be upgraded and who have got the upgrade power. And again we kind of have to assume that whoever's got. This power is honest, so this is a very important security assumption. If you can upgrade the bridge, you can steal all the funds. That's as simple as that and finally and I think this is the most interesting aspect which is often overlooked. Is who's?

A

Got the minting power on the destination right so take again die as an example. uh If you move uh die via three different Bridges, uh let's say: use the uh make a dial bridge and move your die to arbitrum Optimus start net. Your diary will be essentially minted by make a dial contracts right and it will have exactly the same properties as your die on the mainnet.

A

But if you move dive through the polygon bridge, then your die on polygon will be minted by polygon validators and they might actually have the upgrade power of the die. And finally, if you move Dai on Phantom, it will be minted by multi-chain multi-seek right. So again, it's a question to you: I mean how secure you feel with your die in your wallet.

A

uh So this is the last column uh that we show on our framework and, as I said before, uh I guess you know the the the end game for all of us should be to build trustless Bridges, um because everything else uh we need to put our trust on some uh some other parties and these bridges are very very hard to build.

A

We had some problems with arbitrine Bridge. uh There was a bug it was essentially uh fortunately uh uh uncovered, and the bridge wasn't hacked, but uh but, as you can see, you know, uh the roll-up Bridges can be buggy uh same situation happened in optimism, um and this is one of the reasons why uh these bridges are right now not fully yet permissionless and I hope they will be uh very very soon, but even more importantly, as you can see from this transaction, uh that's actually moving. uh How much is it?

A

This is actually seven uh over 700 000 ether from one version of the bridge to another version of a bridge and that power has a arbitrary multi-sig right. So, even though you may think that arbitrine has fraud, proofs and whatnot, uh they still have a multi-stick that can move all the funds from the bridge and they did in this very transaction and it doesn't really raise any alarm so that was kind of uh interesting.

A

um We uh we saw this transaction and you know we analyzed this transaction. It was an upgrade and everyone knew that which one uh was about to upgrade, but seeing such a transaction moving essentially building some funds in one one move. You know it's it's kind of scary.

A

So, to sum up, we kind of think that we have no choice. We have to put engineering effort into uh building those roller Bridges I. Don't think it makes a lot of sense uh moving forward to rely on on third parties uh in the long term.

A

In the short term, they might be quite useful because we need that functionality, but in the long term, eventually we need to find a way to actually make sure that the code behind all these Roll-Ups is actually secure and, as I said before, I mean the code is very, very complex right. These bridges are actually very hard to analyze, I guess for a while. None of these Roll-Ups have shed the training wheels.

A

So so you should really also understand what are the current assumptions, uh but every single team that we talk to they have promised us that, eventually, these training wheels uh will be shed. So there's there's some hope for the future. But how do we make sure that such complex software is bug free and how to make sure that these roll ups will not be hacked in uh ensuing months and I?

A

Think this is probably one of the hardest questions from the engineering perspective and from the perspective of the whole Community, we don't seem to have a solution for dealing with uh discovery of potentially critical bugs without actually relying on some honors actor right. If the bug is found, we all want some good guys to shut down the bridge, fix the bug and restart the bridge without the bug. That's quite obvious right. No one wants really the bridge to be to be drained by uh by malicious actor.

A

However, right now it just seems that the best we can do is to sort of create a multi-sig of some trusted uh security, Engineers, I, guess or a security Council of sorts, and these guys can perform these sudden upgrades and to make it permissionless and to make it immutable. That also means that we are exposed to uh potential problems. So uh so thank you. So much uh for listening and I I do hope that you know the future is bright and and hack free.