Partnered With:

Foreign media: Does Multichain have improper management of user funds?

Read this article in 12 Minutes

If the evidence lines up against Multichain, a worrying situation could arise.

Original source: The Defiant

Original author: Aleksandar Gilbert

According to L2 Beat, a research project analyzing the Layer 2 blockchain space, Multichain is a The cross-chain bridging platform, which locked in a total of $1 billion, has moved nearly $80 million in stablecoins and 300 bitcoins, and the unusual moves have come under scrutiny.

L2 Beat says Multichain moved millions from user funds in escrow to provide liquidity elsewhere on its network , a move that has raised public questions about the purpose of transferring the funds. The moves, and L2's scrutiny, had not previously been reported in the media.

Social Contract

L2 Beat researcher Bartek Kiepuszewski told The Defiant: "Given that this is user money, Multichain's actions to transfer funds are either in agreement with the users on the chain, or they violate the agreement with the users. social contract.”

The vast majority of incidents of stolen and lost cryptocurrency due to hacking attacks this year occurred on cross-chain bridges. Cross-chain bridge technology supports users to transfer digital assets between blockchains.

The reason is clear: the cross-chain bridge technology is complex, which provides more ways for attackers to exploit. Furthermore, they provide a single point of failure: the smart contract locks user funds in escrow, while the “transferred” asset—essentially an IOU—is used on the target chain.

There are many mysteries

So when the researchers at L2 Beat dug deeper into Multichain and found a clear threat from within, they were surprised.

Bartek Kiepuszewski stated that since this is the user's money, Multichain's transfer of funds is either an agreement with the users on the chain. Consistent, or they violated the social contract with users.

According to Kiepuszewski, while the transfer of assets from escrow can be seen on-chain, the ultimate destination of these assets remains unknown .

L2 Beat stated that Multichain claimed that these assets were used elsewhere in its network to provide liquidity, but confirmed whether this claim is true Very difficult.

Michael Lewellen, head of solutions at encryption security firm Open Zeppelin, said there are problems with this approach.

Lewellen told The Defiant: “If there is no clear way to determine that the asset the cross-chain bridge claims to support does not exist publicly verifiable Somewhere, I think we need to pay special attention to this cross-chain bridge.”

L2’s remarks are very important to lock user funds for more than 10 The behavior and security practices of the billion-dollar organization are being questioned. Multichain connects dozens of blockchains and supports the transfer of thousands of assets across chains. Confirming that Multichain still owns the cryptocurrency and that assets have not been stolen or gambled in DeFi protocols will be a difficult task.

New question

Furthermore, the allegations could cast new doubts in the public about cross-chain bridging technology, which has suffered huge losses from hackers this year.

According to Rekt's Vulnerability utilization list, among the hacking incidents that occurred this year, 3 times can be included in the 5 largest hacking incidents in the history of encryption, and these 3 times are hacking attacks on cross-chain bridges. Over $600 million stolen from Ronin Network. Nearly $600 million stolen from Binance Bridge. Over $300 million stolen from Wormhole Bridge.

Multichain did not respond to multiple comments submitted via the email contact address listed on its website ask.

Security Assumptions

This section highlights the role L2 plays in examining the blockchain scaling space. As lending protocol Maker considers whether to expand to layer 2 blockchains like Optimism and Arbitrum, it needs to better understand how those blockchains work.

Subsequent projects eventually spun off from Maker to become L2 Beat - a multi-list A 2-tier blockchain, the amount of funds it holds, and the security assumptions it makes.

This month, the project expands with the introduction of the Bridge Protocol Panel. Next to Multichain, the world's second largest cross-chain bridge protocol, the L2 Beat team also attached a small yellow shield with an exclamation point, warning users that Multichain is suspected of misconduct.

Kiepuszewski explained: "Every cross-chain bridge works more or less the same , the user sends the asset to an address where the "new" asset will be minted by a validator on the target chain. If the user wants to transfer the asset back to the source chain, the reverse process is required, so the user destroys the asset on the target chain, and the verifier should release the asset from the escrow address where the user originally sent the asset. "

Liquid Network

< p>

Cross-chain bridging protocols that cannot mint new assets on the target chain use the method of "liquid network" to bridge assets across the chain. Liquidity providers deposit assets into the liquidity pool on the target chain. These assets are available to users bridged to this blockchain, and when users withdraw their original chain assets, they will be returned to the liquidity pool.

According to L2 Beat, Multichain connects dozens of blockchains, and the above two Both chain bridging methods are used. According to the specific situation, the method of minting assets or building a liquidity pool is adopted.

Kiepuszewski said he contacted Multichain, and a representative told him that encrypted assets had been used to provide cross-border Chain liquidity pool.

Kiepuszewski said: "They claim that this is no problem in their view because the funds are still in Multichain ecosystem, and in their view, users should always be able to withdraw the amount they need." But performing audits "now becomes very complicated because you have to analyze the entire Multichain ecosystem, right?"

Open Zeppelin's Lewellen agrees. “Even with a liquidity network, there is at least a way to look at the different liquidity pools (where liquidity providers are involved in building) and the different chains, and identify the overall assets issued by that cross-chain bridge versus some of the flows elsewhere.

Both Lewellen and Kiepuszewski said that if it could provide a It will be very helpful to alleviate their concerns about the flow of encrypted assets.

Software vulnerability

Kiepuszewski said a new question also arises in assessing whether Multichain is a safe place to store funds. Typically, an audit will confirm whether there are any software vulnerabilities. Now, users also wonder if Multichain itself can be trusted to deposit funds.

Even if funds are kept securely, timely access may be difficult. Lewellen said that this also exposed Multichain's own problems, that is, the asset Dai in Multichain's Fantom bridge seems to be less than Multichain minted on Fantom.

Not yet clear

According to L2 Beat, more than $52 million in Dai was bridged to the L1 blockchain Fantom, and the assets were purportedly removed from escrow by Multichain validators.

According to Lewellen, if Dai loses its peg to the U.S. dollar and is held on Fantom Dai owners who want to convert Dai to USD could lose a lot of money in the process of locating and moving the Dai they should have escrowed.

< p>He said: "The above may not happen immediately, but if these factors are arranged in a way that is not very favorable for Multichain, it may happen. I think this is the ultimate source of concern, it is just not clear about Multichain. How to manage this risk.”