SoK: Cross-Chain Bridging Architectural Design Flaws and Mitigations (2403.00405v1)
Abstract: Cross-chain bridges are solutions that enable interoperability between heterogeneous blockchains. In contrast to the underlying blockchains, the bridges often provide inferior security guarantees and have been targets of hacks causing damage in the range of 1.5 to 2 billion USD in 2022. The current state of bridge architectures is that they are ambiguous, and there is next to no notion of how different architectures and their components are related to different vulnerabilities. Throughout this study, we have analysed 60 different bridges and 34 bridge exploits in the last three years (2021-2023). Our analyses identified 13 architectural components of the bridges. We linked the components to eight types of vulnerabilities, also called design flaws. We identified prevention measures and proposed 11 impact reduction measures based on the existing and possible countermeasures to address the imminent exploits of the design flaws. The results are meant to be used as guidelines for designing and implementing secure cross-chain bridge architectures, preventing design flaws, and mitigating the negative impacts of exploits.
- “Blockchain revolution: how the technology behind bitcoin is changing money, business, and the world” Penguin, 2016
- “A Survey on Blockchain Interoperability: Past, Present, and Future Trends” In ACM Comput. Surv. 54.8 New York, NY, USA: Association for Computing Machinery, 2021 DOI: 10.1145/3471140
- “Bridges Between Islands: Cross-Chain Technology for Distributed Ledger Technology” In 53rd Hawaii International Conference on System Sciences, HICSS 2020, Maui, Hawaii, USA, January 7-10, 2020 ScholarSpace, 2020, pp. 1–10
- “Global Web3 Security Report 2022”, 2023 URL: https://beosin.com/resources/Global_Web3_Security_Report_2022_.pdf
- Chainalysis “The 2023 Crypto Crime Report”, 2023 URL: https://go.chainalysis.com/2023-crypto-crime-report.html
- CertiK “HACK3D: The Web3 Security Report 2022”, 2023 URL: https://www.certik.com/resources/blog/2aHoafYEoeRguK2gE9fD1s-hack3d-the-web3-security-report-2022
- “Security Analysis of DeFi: Vulnerabilities, Attacks and Advances” In 2022 IEEE International Conference on Blockchain (Blockchain), 2022, pp. 488–493 DOI: 10.1109/Blockchain55522.2022.00075
- “SoK: Not Quite Water Under the Bridge: Review of Cross-Chain Bridge Hacks” In 2023 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), 2023, pp. 1–14 DOI: 10.1109/ICBC56567.2023.10174993
- “Xscope: Hunting for Cross-Chain Bridge Attacks” In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, ASE ’22 Rochester, MI, USA: Association for Computing Machinery, 2023 DOI: 10.1145/3551349.3559520
- Briony J Oates “Researching Information Systems and Computing” Sage Publications Ltd., 2006
- team “pGALA post-mortem: measures taken to safeguard the ecosystem from malicious actors and recovery plan”, 2022 pNetwork URL: https://medium.com/pnetwork/pgala-post-mortem-measures-taken-to-safeguard-the-ecosystem-from-malicious-actors-and-recovery-6407048f4497
- Zhiyuan Sun “GameFi project Gala files $28M lawsuit against pNetwork”, 2023 Cointelegraph URL: https://cointelegraph.com/news/gamefi-project-gala-files-28m-lawsuit-against-pnetwork
- “How do bridges work”, 2022 Ethereum foundation URL: https://ethereum.org/en/developers/docs/bridges/#how-do-bridges-work
- “Enabling blockchain innovations with pegged sidechains” In URL: http://www. opensciencereview. com/papers/123/enablingblockchain-innovations-with-pegged-sidechains 72, 2014, pp. 201–224
- Maurice Herlihy “Atomic Cross-Chain Swaps” In Proceedings of the 2018 ACM Symposium on Principles of Distributed Computing, PODC ’18 Egham, United Kingdom: Association for Computing Machinery, 2018, pp. 245–254 DOI: 10.1145/3212734.3212736
- “Protocol Architecture Risk”, 2023 Crosschain Risk Framework URL: https://crosschainriskframework.github.io/framework/20categories/20architecture/architecture/
- Odos “Cross-Domain Arbitrage Tracker”, 2023 Odos URL: https://www.odos.xyz/arbitrage
- “Burn and Mint”, 2023 Crosschain Risk Framework URL: https://crosschainriskframework.github.io/framework/20categories/20architecture/architecture/#burn-and-mint
- Circle “Cross-Chain Transfer Protocol”, 2023 Circle URL: https://www.circle.com/en/cross-chain-transfer-protocol
- SlowMist “Truth Behind the Celer Network cBridge cross-chain bridge incident: BGP hijacking”, 2022 Slow mist URL: https://medium.com/coinmonks/truth-behind-the-celer-network-cbridge-cross-chain-bridge-incident-bgp-hijacking-52556227e940
- Poly Network “PolyBridge”, 2023 Poly Network URL: https://bridge.poly.network/
- THORChain “THORChain explorer”, 2023 THORChain URL: https://thorchain.net/dashboard
- Rekt “Ankr & Helio - REKT”, 2022 Rekt URL: https://rekt.news/ankr-helio-rekt/
- Bifrost “Post-mortem: BiFi-BTC illegal address registration”, 2022 Bifrost URL: https://bifrost.medium.com/post-mortem-bifi-btc-illegal-address-registration-c21ce3ba9fc8
- Rekt “Ronin Network - REKT”, 2022 Rekt URL: https://rekt.news/ronin-rekt/
- Rekt “Multichain - R3KT”, 2023 Rekt URL: https://rekt.news/multichain-r3kt/
- “QANX Bridge wallet disclosure analysis [continuously updated]”, 2022 QAN Platform URL: https://medium.com/qanplatform/qanx-bridge-wallet-disclosure-analysis-continuously-updated-724121bbbf9a
- Multichain “Anyswap Multichain Router V3 Exploit Statement”, 2021 Multichain URL: https://medium.com/multichainorg/anyswap-multichain-router-v3-exploit-statement-6833f1b7e6fb
- Rekt “Poly Network - REKT”, 2021 Rekt URL: https://rekt.news/polynetwork-rekt/
- Rekt “Wormhole - REKT”, 2022 Rekt URL: https://rekt.news/wormhole-rekt/
- “QANX Bridge disclosure analysis [continuously updated]”, 2022 QAN Platform URL: https://medium.com/qanplatform/qanx-bridge-disclosure-analysis-continuously-updated-849f7a91d05e
- Multichain “Multichain Contract Vulnerability Post Mortem”, 2022 Multichain URL: https://medium.com/multichainorg/multichain-contract-vulnerability-post-mortem-d37bfab237c8
- OffcierCia “Post Idea: Found a post-mortem on Zapper Polygon bridge attack, that authors have conducted together with Zapper.fi from their side: My Questions”, 2021 Smart Contract Research Forum URL: https://www.smartcontractresearch.org/t/post-idea-found-a-post-mortem-on-zapper-polygon-bridge-attack-that-authors-have-conducted-together-with-zapper-fi-from-their-side-my-questions/482
- Rekt “Nomad Bridge - REKT”, 2022 Rekt URL: https://rekt.news/nomad-rekt/
- Immunefi “Aurora Withdrawal Logic Error Bugfix Review”, 2022 Immunefi URL: https://medium.com/immunefi/aurora-withdrawal-logic-error-bugfix-review-c5b4e30a9160
- Rekt “THORChain - REKT”, 2021 Rekt URL: https://rekt.news/thorchain-rekt/
- Rekt “Qubit Finance - REKT”, 2022 Rekt URL: https://rekt.news/qubit-rekt/
- Rekt “Meter - REKT”, 2022 Rekt URL: https://rekt.news/meter-rekt/
- Rob Behnke “Explained: The Zenon Network Hack (November 2021)”, 2021 Halborn URL: https://www.halborn.com/blog/post/explained-the-zenon-network-hack-november-2021
- Rekt “THORChain - REKT”, 2021 Rekt URL: https://rekt.news/thorchain-rekt2/
- team “pNetwork Post Mortem: pBTC-on-BSC Exploit”, 2021 pNetwork URL: https://medium.com/pnetwork/pnetwork-post-mortem-pbtc-on-bsc-exploit-170890c58d5f
- Andrew Asmakov “Polygon Dodges 850MHack,PaysRecord850𝑀𝐻𝑎𝑐𝑘𝑃𝑎𝑦𝑠𝑅𝑒𝑐𝑜𝑟𝑑850MHack,PaysRecord850 italic_M italic_H italic_a italic_c italic_k , italic_P italic_a italic_y italic_s italic_R italic_e italic_c italic_o italic_r italic_d2M Bounty”, 2021 Decrypt URL: https://decrypt.co/83997/polygon-dodges-850m-hack-pays-record-2m-bounty
- Neptune Mutual “Decoding Omni Bridge’s Call Data Replay Exploit”, 2022 Neptune Mutual URL: https://medium.com/neptune-mutual/decoding-omni-bridges-call-data-replay-exploit-f1c7e339a7e8
- Ermyas Abebe “Security of Crosschain Transactions and Bridges”, 2022 Ethereum Engineering Group URL: https://www.youtube.com/watch?v=DJyEJVaXMNo%5C&list=PLNLh1EyDzSGPE8UHJBuKpHPnjdGWm2orL%5C&index=2
- Jieliang Yin “Improving Commit-Reveal Scheme and Proposer Builder Separation (PBS) for Better MEV Resistance”, 2023 Ethereum Foundation URL: https://www.notion.so/Ethereum-Grant-Proposal-Resisting-MEV-Attacks-via-Privacy-preserving-Techniques-and-Optimized-PBS-caddad881f9d4d9e901971b84275ca4b
- “Unity is Strength: A Formalization of Cross-Domain Maximal Extractable Value” In Arxiv, 2021 URL: https://doi.org/10.48550/arXiv.2112.01472
- Rekt “BNB Bridge - REKT”, 2022 Rekt URL: https://rekt.news/bnb-bridge-rekt/
- “Introducing Private Transactions On Ethereum NOW!”, 2019 Medium URL: https://tornado-cash.medium.com/introducing-private-transactions-on-ethereum-now-42ee915babe0
- Rekt “Harmony Bridge - REKT”, 2022 Rekt URL: https://rekt.news/harmony-rekt/
- “U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash”, 2023 U.S. Department of the treasury URL: https://home.treasury.gov/news/press-releases/jy0916