The Curse of Cross-chain Bridges: Centralization and Wrapped Tokens Putting Users’ Assets at Risk

Ethereum co-founder Vitalik Buterin sounded alarm last month over the security of cross-chain bridges, most of which are highly vulnerable in the event of 51% attacks. 

Buterin said in a Reddit post that, while blockchains “maintain many of their guarantees even after a 51% attack,” cross-chain bridges open the possibility for the attacker to steal funds by moving tokens onto another chain. 

The wrapping and locking of funds onto other chains by these so-called “cross-chain” protocols are neither trustless nor decentralized. That’s why Portal, a true cross-chain DEX built on Bitcoin, believes in a multi-chain future without wrapped tokens or third-party custody to ensure the safety of users’ assets. Each party’s funds are locked only during trade execution and not re-bonded or replicated onto other chains for eternity.

Portal’s executive chairman Chandra Duggirala said, “Bridges are hard to reason about and secure. Wrapping assets on other chains basically inherits the guarantees of an IOU. When hundreds of Millions and Billions of dollars are being secured by poorly engineered systems and custodians with untested security practices, it becomes hard to secure user funds. Especially given the balance of incentives, with hackers and attackers basically having to get out of jail free cards due to the “code is law” nature of public blockchains, security is especially important. We like simplicity, and trusting proven, lasting contract types and transaction models that Bitcoin has versus all sorts of experimental approaches to real user money.”

MultiChain, THORChain, pNetwork, Poly Network are just some of the cross-chain protocols that suffered security breaches in 2021. Poly Network suffered the biggest DeFi hack ever worth $600 million, though the funds were eventually returned.

More recently, Wormhole lost 120,000 Ether (ETH) worth over $321 million in one of crypto’s largest hacks of all time. The cross-chain protocol failed to validate all “guardian” accounts, which enabled the assailant to spoof guardian signatures and mint 120,000 ETH out of thin air. Jump Crypto, which owns Certus One that developed Wormhole, has replenished Wormhole’s reserves.

Neil Player, Head of Staghead Crypto, a crypto security engineering firm, said “Cross chain bridges present a unique set of security risks and these types of exploits are not a surprise. It is a reminder how bleeding edge a lot of the applications that run on top of blockchains are. Exploits such as what occurred on Wormhole are expected to cause growing pains as the technology and techniques associated with bridging assets matures.”

There are two key risks with cross-chain solutions. First, they increase the number of attack vectors for the assets across a wider network surface area. Second, most cross-chain bridges facilitate asset transfers through a variety of centralized federations and external validators that may no longer remain decentralized and trustless. In short, they are too centralized.

Johnny Dilley, the inventor of Liquid Federation (Blockstream) noted, “Custody is hard -- explaining to people in DeFi why their assets are often in the custody of others is even harder! Thefts from platforms like Moonbeam underscore the difficulty associated with properly safe & secure means of transfer between chain environments -- without an attitude of constant vigilance (like those used by systems with dedicated hardware security, or strict key-ownership-is-ownership policies), users without the capacity to evaluate the trustability of the systems they use will continue to be robbed blind. The industry needs a smarter, permanent answer for cross-chain asset movement, and Portal represents the best step forward on that path. “

The peer-to-peer atomic swaps underpinning Portal provide true decentralization, enabling users to trade native Layer-1 assets across different blockchains without delays, blocked funds, or exploits. There is no central server or host, making Portal highly resistant to attacks. 

In atomic swaps, either the entire transaction occurs completely and both parties receive the exchanged assets, or the transaction rolls back and both parties retain ownership of their existing assets. There’s no room for either party to exploit any stage of the transaction.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.