Hacking incidents occur frequently, how to choose a relatively safe cross-chain bridge?

After the industry quickly entered the multi-chain ecology, users' demand for cross-chain bridges has also become stronger. However, in the current market, the official bridges of each public chain often support a limited number of chains. Therefore, third-party cross-chain protocols have become the mainstream choice for users to cross-chain by virtue of the wider number of public chains supported. At the same time, cross-chain bridges have also become the coveted target of hackers.

On the past January 18, the third-party cross-chain protocol Multichain (formerly Anyswap) was hacked again, with a total loss of about 600 Ten thousand U.S. dollars.

Due to the frequent occurrence of security incidents on cross-chain bridges recently, in order to help readers avoid possible risks in use, we will summarize the recent cross-chain bridge security incidents A brief summary was made.

Review of cross-chain bridge security incidents in the past year

On June 29, 2021, THORChain suffered its first attack and lost about $350,000. In the following July, THORChain encountered two attacks in succession, resulting in a loss of approximately US$16 million.

On July 11, 2021, ChainSwap was attacked, and the official freeze of the BSC mapping Token address to filter out hacker addresses. The partner RAI Finance has stolen more than 700,000 RAI Token due to a ChainSwap contract loophole.

On July 12, 2021, Anyswap announced that the newly launched V3 cross-chain liquidity pool was hacked in the early hours of yesterday, with a total loss of 239 10,000 USDC and 5.5 million MIM, the total loss exceeds 7.87 million USD

On August 10, 2021, Poly Network (O3 Swap) was hacked, and about US$610 million in assets was transferred.

On November 7, 2021, the cross-chain protocol Synapse (formerly known as Nerve) was hacked, and about $8 million in assets were affected .

On November 23, 2021, the Celo official bridge Optics cross-chain bridge multi-signature wallet ownership was transferred by an unknown person, and Optics cross-chain bridge was suspended.

On January 18, 2022, Multichain (formerly Anyswap) was hacked again, with a total loss of about 6 million US dollars.

Are security incidents just due to bad luck?

Regarding the recent Multichain security incident, @0x_Todd commented that for DeFi applications, as long as there is a security problem once, there will be problems one after another. And if there is no problem with an agreement, it will never go wrong.

Of course we know that this sentence has a certain sense of ridicule, and it cannot really be used as a theorem to evaluate project risks. However, judging from some cases in the industry, those projects with a record of safety accidents are indeed more likely to roll over one after another. For example, Cover, a well-known DeFi insurance project, was repeatedly attacked by hackers before returning to zero. The insurance agreement itself is not insured, and the Cover agreement has simply become a portable cash machine for hackers.

In fact, the reason for this phenomenon is that the occurrence of security incidents is not an accidental event, which reflects the internal release process of the application development team There may be serious problems in terms of risk control awareness and so on.

The occurrence of accidents is often only the external manifestation of internal management failure. If the internal risks and hidden dangers cannot be completely eliminated, but only the superficial problems are solved with headaches and feet, then similar safety accidents will only continue to appear one after another.

However, many entrepreneurial teams in the encryption industry do not have a relatively rigorous work attitude in their work. They often continue to push forward the development progress of the project and seize the market after hastily solving the immediate fault, which makes the risks and hidden dangers accumulated within the agreement more and more serious.

So, for ordinary users, how can we find a relatively reassuring cross-chain bridge today when cross-chain has gradually become a rigid demand?

Here we first make a correction to the "theorem" mentioned by @0x_Todd before. First of all, a protocol that has no security risks at present does not mean absolute security. However, if the TVL added to this protocol is large enough, and the protocol has been online and running for a long enough time, then it can be said that its security risk is relatively low. After all, for such a piece of "fat meat", its code must have been repeatedly analyzed by various top hackers.

In addition, if it is too absolute to say that all agreements that have had one security incident have been killed with a stick, then for those that have occurred twice or more in a row The agreement of the accident is to keep it as far away as possible.

Finally, according to this standard, we conduct a third-party cross-chain bridge for TVL that has a certain scale in the market and has a wide range of public chain compatibility. took stock.

Of course, since the multi-chain ecology and cross-chain bridges are basically the result of rapid development in the past year, the tests experienced by these protocols may not be sufficient . For the cross-chain bridges listed below that have not had any security issues, users are still advised to use them with caution under the premise of controlling their own risks.

Inventory of third-party cross-chain bridges with good security records

AllBridge

Allbridge is a cross-chain bridge developed by the APYSwap team. Its main feature is to support mainstream non-EVM chains (such as Solana, Terra) cross-chain while supporting mainstream EVM compatible chain cross-chain .

Available: July 2021

TVL: $546 million (DeFi Llama data on January 20)

cBridge

cBridge  is the EVM chain (including Layer 2) The most cross-chain bridges, which basically completely cover the EVM compatible chains that can be seen on the market, now support cross-chain bridges of 19 chains and layers. Its total cross-chain funds have reached 2.4 billion U.S. dollars, and its lock-up volume has also experienced rapid growth after the launch of the V2 version, and currently exceeds 200 million U.S. dollars.

Unlike other third-party cross-chain bridges that only target asset cross-chains, cBridge's goal is even more ambitious. In addition to doing a good job in cross-chain assets, cBridge also recently released the Celer Inter-chain Message framework (Celer Inter-chain Message, Celer IM for short), officially entering the field of information cross-chain, trying to become the platform for cross-chain interoperability in the future multi-chain ecology. The underlying infrastructure protocol.

According to the official documentation, the new generation of multi-chain native dApp built on Celer IM will become the first batch of native cross-chain dApps in the future multi-chain world application. It can help users pledge assets on one chain and directly lend assets on another chain, or allow users to exchange assets across multiple chains in one transaction.

Available: July 2021

TVL: $195 million (cBridge official Jan. 21 data)

Hop Protocol

The outstanding advantage of Hop Protocol is that it not only supports cross-chain of mainstream EVM chain, but also supports cross-chain of mainstream Layer 2 on Ethereum such as Arbitrum and Optimism. The types of cross-chain assets currently supported include ETH, USDC, USDT, DAI, and MATIC.

Available: July 2021

TVL: $106 million

xPollinate (Connext)

XPollinate also supports a wide variety of cross-chains. In addition to mainstream EVM-compatible chains, it also supports Layer 2 cross-layers and cross-chains of Polkadot ecological EVM-compatible parachains.

Online time: September 19

TVL: $26.68 million

At the end of the article, the risk is reminded again, Projects that have not had safety accidents in the past do not mean absolute safety. When users use cross-chain tools, it is still necessary to maintain good account usage habits. Such as clearing up authorization in a timely manner, or managing the main asset storage address separately from the daily interaction address, etc. After all, in the encrypted world where individuals have absolute sovereignty, the only ones responsible for ourselves are actually ourselves.  

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia