Macauley Peterson

“We’re so early,” as the crypto meme goes, but when it comes to the experience of working as a Web3 developer, that’s not necessarily a good thing.



There are multiple challenges facing blockchain-focused teams looking to attract developer talent, sources tell Blockworks. These range from finding funding in a bearish macro environment, to the novel smart contract programming languages and practical considerations such as infrastructure and workflow tools.



Forcing devs to deal with novel workflow issues is a problem with serious consequences — not merely a drain on productivity, but, with money on the line in decentralized finance, major financial losses result when security missteps occur. Just ask <a href="https://blockworks.co/tag/bridges">cross-chain bridge users</a>.



San Diego, California-based Cubist, which announced the close of its $7 million seed round today, is focusing on the tools software engineers need for multichain and cross-chain development.



The round was led by Polychain Capital, with participation from venture capital and other investors including dao5, Amplify Partners, Polygon, and Axelar.



The company’s initial focus is on chains supporting the Ethereum Virtual Machine (EVM), CEO and co-founder ​​Riad Wahby told Blockworks, noting Ethereum has the most well established developer tooling, but only for the needs of individual developers, not larger more professional developer teams.



Some in the crypto space use the lack of developer familiarity with <a href="https://www.blockworksresearch.com/glossary#solidity-programming-language-ethereum">Solidity</a>, Ethereum’s smart contract language, “as an excuse,” Wahby said.



“I think there is a slice of the developer ecosystem in Web2 that’s basically like Javascript or nothing…but I don’t think that’s actually the problem,” he said, adding, “I think the actual problem is, all the other tooling that goes along with developing serious applications in Web2 is just totally missing.”



Wahby cited continuous integration testing — automating the merging of code changes from multiple contributors into a single software project — as one example where Web3 falls short.



“That’s still nascent technology, whereas in Web2 that’s just table stakes,” he said.



<h2>There are only so many early adopters</h2>



For Web3 startups, the goal should be attracting developers that are not going to be your fanatics, they’re going to be your customers, according to Dean Tribble, CEO of Agoric, a company facilitating building DeFi dapps in JavaScript.



“It’s fine to get fanatics, but there are just a limited number of them, and the goal is to transition to where we get lots and lots of customers from this platform technology.”



There is certainly the programming language aspect, Tribble said, noting that the number of JavaScript developers in the world sits at 15 million and the language&#8217;s strengths in building frameworks of components — composable software from many different contributors.



“Being able to build on the shoulders of others is critical,” he said.



But a more salient problem right now is the overall market downturn. “People don’t communicate what’s the value [proposition] of it, for people solving their own problems…what’s the actual advantage here?”



Among the obstacles: New jargon, new patterns, the security hazards, the perceived fraudulent behavior — “scummy, scammy behavior,” as Tribble put it.



“FTX’s same-old-same-old brokerage fraud of mixing customer funds with investment — the fraud part didn’t have anything to do with Web3, the technology stack and what opportunity is enabled, and yet from 10,000 feet it all looks like a mess,” he said.



Tribble expects to see applications that rely on other chains bringing their value, but acknowledges the potential downside of application dependency, a form of counterparty risk.



One example is Agoric’s own stable token IST, which can be minted from Ethereum-based stablecoins like DAI, USDC and USDT that are brought over to Cosmos via bridges like Axelar and Gravity.



“But if one of those bridges goes down, that impacts our business and reputation even though we do not have control over those bridges.”&nbsp;


<div class="wp-block-image">
<figure class="alignright size-full is-resized"><img decoding="async" loading="lazy" src="https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg" alt="" class="wp-image-48723" width="250" height="250" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=500 500w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=150 150w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=257 257w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=261 261w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=219 219w, https://blockworks-co.imgix.net/wp-content/uploads/2023/03/Wahby.jpeg?w=80 80w" sizes="(max-width: 250px) 100vw, 250px" /><figcaption class="wp-element-caption">​​Riad Wahby; Source: Cubist.dev</figcaption></figure></div>


That’s among the problems Wahby’s team at Cubist aims to tackle — to improve the ability for developers to safely build and deploy multichain.&nbsp;



“I love the hacker ethic — of course that’s part of the reason why we love to work in Web3 — but I also want somebody who’s going to give me a [Service Level Agreement],” Wahby said.



Cubist is building tools for interchain developers, using the Axelar Virtual Machine (AVM), a new piece of permissionless infrastructure, Axelar’s content lead Galen Moore told Blockworks.



Axelar has a mission to make building interchain-native applications easy, as co-founder Sergey Gorbunov said at the recent <a href="https://interopsummit.com/">Interop Summit</a> in Denver, where he described how developers spend 70-80% of time dealing with the minutiae of software deployment in a multi-chain stack as opposed to being able to focus on building application logic.



“It&#8217;s possible to make Web3 easier — maybe even easier than traditional web development,” Moore said.



Gorbunov sees the development of Ethereum and Cosmos coalescing in the future.



“In some sense now the Cosmos stack I think is becoming more and more glued together with the EVM stack, and I think, as time goes by, these are going to be indistinguishable ecosystems, I believe,” Gorbunov said.



<h2>But first, solving the money problem</h2>



No matter how interested in Web3 potential developers are, teams have to be able to pay them. Griffin Anderson, CEO of Phi Labs, is seeing foundations reneging on promised grants, and projects funded by token issuance are suffering from the bear market downturn in token prices.



“There’s tons of demand to build apps and projects, but I would say the overwhelming 50 or 60 percent are depending on a financial grant in some capacity,” Anderson told Blockworks.



“It’s not like they don’t know Web 2.0 engineers and don’t want to bring their friends into the space, it’s that they can’t pay their salaries, at the end of the day, in this environment,” he said.



A core contributor to Archway, Anderson is working on devising alternative incentive mechanisms to bring more developers into Web3 by leveraging the underlying strengths of the technology.



The basic concept behind Archway, which is also Cosmos-based, is to programmatically reward developers based on the value and users they bring to the network.



Finding applications that excite developers and play to the strengths of Web3 can help, Tribble said. Testing applications across multiple machines, let alone multiple chains, presents novel problems.



“That’s rarely something engineers have experienced in non-crypto…[but] it is one that Web2 engineers actually find enticing — that’s interesting from an engineering point of view — it’s part of the attraction,” he said.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Solving Web3’s Developer Problem: Web2 Remains Hesitant

Casey Wagner

Uniswap has assembled a team of six engineers to evaluate bridge providers as the protocol plots expansion after a record year for bridge hacks in 2022.



The Uniswap Bridge Assessment Committee will look at eight bridges and three bridge-agnostic solutions, the protocol announced Thursday. The team is tasked with evaluating the providers and making recommendations.&nbsp;



“With a focus on the needs of Uniswap governance, they will leverage this diligence to provide a short-term recommendation for how the Uniswap community might approach bridges in the coming weeks,” Devin Walsh, executive director of the Uniswap Foundation, <a href="https://gov.uniswap.org/t/cross-chain-bridge-assessment-process/20148/46">wrote</a> in the governance forum.



The eight bridge providers the committee will focus on are Axelar, Celer, deBridge, Hyperlane, LayerZero, Multichain, Router Protocol and Wormhole. The bridge-agnostic solutions are multi-bridge implementation, built by the Celer team; Block Header Oracle based solution, being built by the Gnosis team; and <a href="https://eips.ethereum.org/EIPS/eip-5164" target="_blank" rel="noreferrer noopener">ERC-5164</a>. 



Bridges in DeFi allow two or more blockchains to share data, allowing for users to participate and engage with multiple protocols and access assets across networks. The newer technology seeks to solve a major pain point for the industry, but they are also vulnerable to hacks and security breaches. Bridge-agnostic solutions are not tied to one blockchain and can be used across many protocols.&nbsp;



<a href="https://blockworks.co/news/cross-chain-bridge-thefts-top-1b-in-2022">Cross-chain bridge thefts exceeded $1 billion in 2022</a>, according to analytics and compliance firm Elliptic. <a href="https://blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m">Harmony</a>, <a href="https://blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m">Sky Mavis</a> and <a href="https://blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether">Wormhole</a> were among the largest to suffer blockchain exploits last year, totaling more than $100 million.&nbsp;



Uniswap assembled their committee members with technical experience and high-level understanding of bridge architecture and risk points, Walsh said in the post. The protocol tapped Sean Casey, the co-chief technology officer and head of Enzyme Protocol Development at Avantgarde Finance, and Ben O’Neill, vice president of business operations at Chaos Labs — among others. 



The team plans to expand in the next few weeks, Walsh added, noting that anyone qualified can reach out to her.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Crypto Bridges Tend To Collapse: How Uniswap Is Optimizing for Safety

Few pieces of blockchain infrastructure have proven to be both more necessary and more fragile than cross-chain interoperability protocols, commonly known as <a href="https://blockworks.co/tag/bridges">bridges</a>. Whether you favor Ethereum layer-2 rollups, or an <a href="https://www.blockworksresearch.com/research/2022-in-review-network-coverage-layer-1s-and-2s">app-chain thesis</a> such as Cosmos or Avalanche <a href="https://www.blockworksresearch.com/research/avalanche-subnets">subnets</a>, a <a href="https://blockworks.co/tag/multichain">multichain</a> future requires data and value to flow between chains.



But so far no one has conclusively solved the engineering problems to make cross-chain communication safe, fast and cheap — to wit, estimates put the total value <a href="https://twitter.com/WuBlockchain/status/1578295159850405888">lost</a> to hacks and exploits at upwards of $2 billion since 2021.



The latest startup to try is Orb Labs, which announced a $4.5M seed round Tuesday, led by Bain Capital Crypto, with participation from Shima Capital, 6th Man Ventures, Aves Lair, Newman Capital, Modular Capital, and SevenX Ventures.



Co-founders Richard Adjei and Felix Madutsa told Blockworks, exclusively, that their goal is “to make it possible for the everyday people to find Web3 to be a comfortable place to be.”



“We think fundamentally, messaging protocols are the last piece of Web3 scaleability,” Adjei said. &#8220;Their primary use case is to help amortize block space demand.”



That entails moving some computation to chains which are cheaper to use, like layer-2s, while keeping assets safely secured on a trusted chain such as Ethereum.&nbsp;



<h2>Efficiency versus security</h2>



To date, there have been three main types of cross-chain protocols:



<ol>
<li>Consensus light clients such as <a href="https://blockworks.co/tag/IBC">Cosmos’ IBC</a>, which are highly secure and trust-minimized;</li>



<li>Validator-based systems — the majority approach taken by Wormhole, LayerZero and Axelar — which have a set of validators verify messages off-chain; and</li>



<li>Optimistic messaging systems — the Nomad bridge being the most prominent — that rely on off-chain validity checks during a dispute window, much like <a href="https://www.blockworksresearch.com/glossary#optimistic-rollup-or">optimistic rollups</a>.</li>
</ol>



Each have their pros and cons, balancing the tradeoffs between speed, cost and security. The latter has sometimes been challenging in practice; <a href="https://blockworks.co/news/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses">Wormhole</a> and <a href="https://blockworks.co/news/nomad-recovers-nearly-20m-of-stolen-190m">Nomad</a>, for instance, suffered exploits to the tune of hundreds of millions of dollars in 2022.



Orb Labs “went back to the drawing board” as Adjei and Madutsa put it, and came up with Earlybird, which uses “different libraries that get to the peak in terms of usability and security,” Adjei said.



Of course, they had to have catchy names.



Thunderbird, the most gas-efficient, uses a validator scheme much like existing popular protocols, but the team claims their solution delivers a greater than 20x cost savings.



The Rukh library is an optimistic messaging system which side-steps the problem that confronted Nomad.



Caladrius is the most trust-minimized — a consensus light client-based option that Adjei said will be cheap enough to work on Ethereum. By contrast, he estimates an implementation of IBC on Ethereum would cost on the order of $500 million per year.



Finally, Griffin, a library that combines the previous three, gives developers maximum flexibility, according to Orb Labs.



The basic idea is to allow applications to switch between the libraries based on the nature of their particular needs, dialing down security to reduce costs, or upping security with a more trust-minimized solution, when required.



This new approach is a major part of why venture investor Yida Gao, general partner at Shima Capital, sees room in the bridge market for a new player.



“We think that there’s a second-mover advantage when it comes to building cross-chain communications protocols,” Gao told Blockworks.



None of these solutions is yet in production, but the team plans to use the new seed funding to bring the vision to reality. That means hiring, scaling the tech, conducting security audits, and finding launch partners.



“We’ve talked to a few [layer-1s] that are exploring ways to build really robust native bridges, partly because the thing they all need to solve is there are not good solutions other than multisigs,” Adjei said.



<h2>“Future-proof interoperability”</h2>



Other messaging protocols are moving in a similar direction. The team’s vision is similar to what Axelar co-founder Sergey Gorbunov <a href="https://axelar.network/blog/future-proof-interop-path-adaptability-for-cross-chain-dapps">calls</a> “a concept of future-proof interoperability,” working towards a decoupling of the interoperability layers.



“Developers can build their dApps based on specific message semantics, while the underlying validation and transport layers can be adapted and improved over time,” Gorbunov wrote on the Axelar blog.



Gorbunov disputes the idea that validator-based systems are inherently less secure, noting that even the gold standard IBC <a href="https://forum.cosmos.network/t/ibc-security-advisory-dragonberry/7702" target="_blank" rel="noreferrer noopener">encountered</a> critical bugs last year. After “two bugs in the same week, the full Cosmos community was like on fire having to deal with those things — thankfully nobody lost money,” Gorbunov told Blockworks.



But he agreed that there’s still room for innovation in cross-chain architecture, noting that “Besides security and robustness challenges, the architecture of interchain dApps needs to be revisited from the ground up.”



Orb Labs’ first product, MagicLane, is a token wrapping feature to send tokens from one chain to another very easily, and is built on top of Earlybird.



“The whole idea behind messaging protocols is everything becomes a cross-chain message, because we’re sort of like moving computation, transactions and users to the most scalable chain at any given point in time,” Adjei said.



“That’s the only way we enter this world in Web3 where most every transaction is free.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Rethinking Bridges: Orb Labs Imagines World Where Every Transaction is Free

The hidden costs of centralization have been on display in spades this year, between the bankruptcies of centralized lending platforms and exchanges, <a href="https://blockworks.co/tag/ftx" target="_blank" rel="noreferrer noopener">especially FTX</a>. Non-custodial decentralized exchange (DEX) ThorChain, meanwhile, has flown under the radar — despite its unique connection to Bitcoin and growing user base.



The DEX is known for being the first — and by far the largest — to facilitate cross-chain swaps between native bitcoin and other networks. Previously, this kind of cross-chain asset transfer required a centralized exchange like Binance or Coinbase: Deposit bitcoin, sell for ether and withdraw to Ethereum — or use a custodial wrapped asset, such as <a href="https://blockworks.co/price/wbtc" target="_blank" rel="noreferrer noopener">WBTC</a>, on Ethereum.



That’s the main problem that developers of ThorChain — which is based on the <a href="https://blockworks.co/tag/cosmos" target="_blank" rel="noreferrer noopener">Cosmos</a> software development kit (<a href="https://www.blockworksresearch.com/glossary#cosmos-software-development-kit-sdk" target="_blank" rel="noreferrer noopener">SDK</a>) — set out to solve. The network beta version launched in April, 2021.



<blockquote class="wp-block-quote">
“Instead of trying to bring bitcoin to DeFi via a wrapped asset, let’s bring DeFi to bitcoin,” Chad Barraford, the project’s technical lead, told Blockworks.
</blockquote>



The DEX is conceptually “asset agnostic,” with Barraford likening the notion of being locked into any one crypto ecosystem as “like being a computer manufacturer that will only sell to Japan.”



There have been some forks — attempts to improve on ThorChain’s open-source code — such as Maya Protocol, and Chainflip, but, according to Barraford, “there hasn’t been a design for interacting with bitcoin that maintains economic security, other than ThorChain.”



<h3>Improving the utility of Bitcoin and DeFi user experience</h3>



ThorChain’s integration with <a href="https://blockworks.co/price/twt" target="_blank" rel="noreferrer noopener">Trust Wallet</a>, a self-custodial, multi-chain wallet provider, is a move to expand the user base of both: Trust Wallet — which is <a href="https://www.binance.com/en/support/announcement/binance-acquires-trust-wallet-a-secure-mobile-crypto-wallet-360010790652" target="_blank" rel="noreferrer noopener">owned by</a> the world’s largest centralized exchange, Binance — brings 10 million active users, a spokesperson told Blockworks. Thorchain, meanwhile, has logged about 62,000 addresses and 9.3 million transactions over its history, according to the <a href="https://thorchain.net/dashboard" target="_blank" rel="noreferrer noopener">latest data</a>.



Blockworks Research analyst Dan Smith said the integration is a significant step.



“People like simplicity,” Smith said. “[You] don’t have to use a site you are unfamiliar with.”



ThorChain, after all, hovers among the top four options in terms of bridge volume, and even did a stint at No. 2 during the peak of the November FTX-driven sell off.



The biggest problem, as many DeFi projects are discovering, is liquidity, according to Barraford.



“The more shallow the pools are, the higher the swap fees will be,” he said. “We do a slip-based fee model, not a straight 30 [basis points] like Uniswap]. At some stage it’ll be uncompetitive, like right now the pools are very very shallow, largely because it’s a bear market.”



That pushes up transaction fees as a result of slippage between traded assets. If ThorChain can attract enough liquidity, the swap fees can drop to become even cheaper than Binance, as they already were during the height of the last bull market.



A new product, “Savers”, launched in November, allows native bitcoin to be included in liquidity pools — without the risk of impermanent loss, or the need to whole any of Thorchain’s native token, RUNE.



That should appeal to bitcoiners, Barraford said, “who want to earn BTC on their BTC” but have no interest in RUNE as an asset.



The eventual goal, he said, is DEX aggregation — giving users the ability to conduct multiple cross-chain swaps in a single transaction, would be a huge improvement to user experience.



<h3>Promoting DEX benefits</h3>



The turmoil associated with the downfall of FTX and other centralized parties may help refocus attention on truly decentralized projects.



“Users are now more motivated than ever to capitalize on the benefits of self-custody,” Barraford said in a statement. “The latest market developments emphasize the importance of transparency and self-custody, features that are inherent in decentralized finance (DeFi).”



There are even efforts to bring institutional capital into the ThorChain sphere, with firms such as Nine Realms, whose CEO Gavin McDermott commented that, “beyond the philosophical appeal of self-custody, people will use THORChain because it provides an excellent user experience and feature parity with centralized counterparts.”



The biggest risk to the ThorChain narrative seems to be its complexity. Even sophisticated crypto builders like Solana Labs co-founder Anatoly Yakovenko have been confounded by its economic design.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Thor is great, but it carries similar risks as wormhole. There exists a set of keys not your own that can spend your crypto.&mdash; toly 🇺🇸 (@aeyakovenko) <a href="https://twitter.com/aeyakovenko/status/1603426133348712455?ref_src=twsrc%5Etfw">December 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



This claim — that “it carries similar risks as [Wormhole]” — is objectively false according Smith, who said, “risks do certainly exist, but very different,” with ThorChain.



“Economic security is so important,” Barraford said. Theoretically, a hacker would need to simultaneously compromise the private keys of all of ThorChain’s decentralized active nodes — <a href="https://thorchain.net/nodes" target="_blank" rel="noreferrer noopener">currently 86 of them</a> — to steal the network’s assets. But the validators themselves must escrow a security bond in RUNE such that their own economic incentives <a href="https://twitter.com/ChadThoreau/status/1603433481547096065" target="_blank" rel="noreferrer noopener">prevent malicious action</a>.



Otherwise, it would certainly spell trouble for the ThorChain token, but that’s by design — it also keeps network participants honest. Thus, the token is a critical part of what makes native cross-chain swaps possible.&nbsp;



“The value of the RUNE that I bought would go to zero…We needed an asset that would go to zero, in order to maintain economic security.” Barraford said.



Update, Dec. 15, 11:54 p.m. ET — Yakovenko elaborated in <a href="https://twitter.com/aeyakovenko/status/1603597553009770497" target="_blank" rel="noreferrer noopener">a follow-up tweet</a> that he was referring not to ThorChain&#8217;s economic design, but to the risk of an unnoticed remote code execution (RCE) — a malicious bug — in the node software or hardware.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Native Bitcoin in DeFi — This DEX Wants to Boost Trust

Bessie Liu

<div id="highlights-block_63503e90e7211" class="highlights">
 <ul>
 <li>This vulnerability was not in Optimism’s code, but rather in a custom bridge provided by BitBTC</li>
 <li>BitBTC’s custom bridge code did not acknowledge the specific layer-2 token being minted to the layer-1 address</li>
 </ul>
 
</div>



A Twitter user has helped avert a potential exploit after publicly flagging a vulnerability in BitBTC’s Optimism bridge — the latest such near-miss amidst a year full of “successful” thefts.&nbsp;



Lee Bousfield, a tech lead at Ethereum scaling solution Arbitrum — PlasmaPower0 on Twitter — published what he dubbed a critical exploit after he said his messages were ignored by BitBTC.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">BitBTC&#39;s Optimism bridge is trivially vulnerable. Their team has ignored my messages, so I&#39;m going to publish the critical exploit here. 🧵<a href="https://t.co/onyN9SzBjt">https://t.co/onyN9SzBjt</a>&mdash; Lee Bousfield (@PlasmaPower0) <a href="https://twitter.com/PlasmaPower0/status/1582176532985880576?ref_src=twsrc%5Etfw">October 18, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The BitBTC bridge to or from Optimism&#8217;s blockchain facilitates withdrawals of any token between layer-2 and a corresponding layer-1 wallet. But, the BitBTC code involved does not acknowledge what the layer-2 token actually is —and mints an arbitrary layer-1 to match. 



“That means an attacker could deploy their own token on Optimism, give themselves all the supply, and set that token&#8217;s L1Token to the real BitBTC L1 address,” Bousfield tweeted.



<blockquote class="wp-block-quote">&#8220;When the attacker withdraws their malicious token through the BitBTC bridge, it gives them real BitBTC tokens on L1,&#8221; he said.</blockquote>



Of note, the apparent vulnerability was not in Optimism’s code, but rather in a custom bridge facilitated by BitBTC, according to Kelvin Fichter, an Optimism developer. Meaning, he said, no assets other than BitBTC assets were at risk.



“We put a lot of time and energy into the standard bridge and I highly recommend using the standard bridge rather than rolling your own custom bridge unless you really know what you&#8217;re doing,” Fichter <a href="https://twitter.com/kelvinfichter/status/1582401761650036738" target="_blank" rel="noreferrer noopener">tweeted</a>.



The next day, an attacker — who claimed he was testing the code, tried to withdraw 200 billion BitBTC from Optimism.&nbsp;



The exploit was able to be stopped as the process of withdrawing the token from the bridge would have taken seven days, and BitBTC in the interim patched the vulnerability via a software update.



“The attacks will now fail when they arrive on L1. Thanks everyone for making noise and helping get this fixed,” Bousfield <a href="https://twitter.com/PlasmaPower0/status/1582549048292446210" target="_blank" rel="noreferrer noopener">tweeted</a>.



Bousfield did not immediately return a request for comment.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

How Twitter Helped Avert a Critical Exploit

<div id="highlights-block_62e992a973757" class="highlights">
 <ul>
 <li>Bridge protocols are popular targets for hackers as the blockchain-to-blockchain solutions grow in popularity and usage</li>
 <li>Web3-oriented protocols may need to begin deploying tried-and-true Web2 cybersecurity measures, a specialist told Blockworks</li>
 </ul>
 
</div>



In 2022’s latest hack of a crypto bridge, Nomad lost a substantial sum in a hack made possible by a routine upgrade that allowed nefarious actors to skip verification messages and steal more than <a href="https://cms.blockworks.co/nomad-token-bridge-raided-for-190m-in-frenzied-free-for-all/" target="_blank" rel="noreferrer noopener">$190 million</a>.&nbsp;



Crypto bridges enable transactions between different blockchains without a third-party to facilitate the exchange. The Nomad hack is now the third-largest bridge hack this year behind Wormhole, where <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/" target="_blank" rel="noreferrer noopener">hackers drained $325 million</a> in February, and Ronin, where <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">$625 million was stolen</a> from its blockchain in March.



The Nomad hack was an implementation bug that didn’t stem from transactions going awry, said Dmitriy Berenzon, a research partner from early-stage token fund 1KX.



<blockquote class="wp-block-quote">“The attack didn’t come from transactions that went over the bridge, it’s an exploit of the contracts on Ethereum — it’s more issues in the code itself, rather than the theoretical security model,” Berenzon told Blockworks. “This is unlike the other hacks we’ve seen where the actual Root of Trust (RoT) is compromised.”</blockquote>



Cryptographic systems depend on RoT to secure operations. A compromised RoT implies that the keys to encrypt and decrypt data on the hardware are broken.



Blockchain bridges have become popular targets for crypto-savvy hackers, namely because of the complexity of their underlying smart contracts. Such vulnerabilities have drawn criticism from the likes of Ethereum founder <a href="https://cms.blockworks.co/tag/Vitalik-Buterin/" target="_blank" rel="noreferrer noopener">Vitalik Buterin</a> who previously <a href="https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8/" target="_blank" rel="noreferrer noopener">said</a> bridges have “fundamental security limits” that make him pessimistic about ​​cross-chain applications.



“The scariest part about bridged assets is the domino effects in the unhappy case,” Berenzon said. “Assets are used and integrated into different protocols, and if there is an issue with one bridge, it can get wrapped into another bridge — so, you have a cascading systemic risk that is potentially hard to unwind.”



An example of asset integration would be if you had ether that you want to switch to Polygon to leverage its cheaper gas fees — you would send your ETH to a bridge address on an Ethereum blockchain. Once your deposit is received, your ETH will become “wrapped,” making it compatible with Polygon and easier for you to perform transactions on the layer-2 network.&nbsp;



It’s impossible to mitigate risk completely, Berenzon said — but minimizing loopholes as bridges grow in usage is paramount.&nbsp;



<a href="https://www.linkedin.com/in/hugh-brooks/" target="_blank" rel="noreferrer noopener">Hugh Brooks</a>, a product director at blockchain security firm CertiK, said bridges are going to take on an increasingly larger role as developers, envisioning a multichain future, are no longer content to build on a single blockchain.



Rather, Brooks said, the Web3 ecosystem ought to benignly deploy Web2 cybersecurity attitudes.



“We need to have a full security mindset and to be testing at each step of the way,” Brooks told Blockworks. “If [Nomad] had a response team in place to respond to the hacks, they might have been able to shut it down or execute a hack themselves to prevent others from taking that money. Although there were white hackers who did intervene, you’re not always going to be able to rely on the community for these kinds of incidents.” 



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

After Latest Crypto Bridge Hack, Industry Participants Call for Tighter Security

David Canellis

<div id="highlights-block_62e907e74b5d3" class="highlights">
 <ul>
 <li>The Nomad incident is the third-biggest cryptocurrency hack of the year, behind Wormhole and Ronin</li>
 <li>Around 41 addresses siphoned cryptocurrency from the protocol</li>
 </ul>
 
</div>



Token bridge Nomad has suffered a “frenzied free-for-all” after attackers raided the protocol for more than $190 million in cryptocurrency.



Nomad, which marketed itself as a “security-first” platform for sending ERC-20 tokens between compatible blockchains, confirmed the raid in a Tuesday morning tweet.



&#8220;Nomad identified an attack on its token bridge on August 1 at approximately 5:32 PM Eastern Time (ET),&#8221; the company said in a statement emailed to Blockworks. &#8220;An investigation is ongoing and leading firms for blockchain intelligence and forensics have been retained. Nomad has notified law enforcement and is working around the clock to address the situation and provide timely updates.&#8221;



The incident differs from other large-scale hacks to cripple token bridges this year. Token bridges enable crypto users to port digital assets over networks by first locking them inside a smart contract.&nbsp;



The bridge then issues a derivative token, a “wrapped asset,” on the other side, with their values backed by their original deposits. Nomad supports Ethereum, Avalanche, Evmos and Moonbeam.



February’s Wormhole hack saw attackers exploit buggy smart contract code to mint themselves $320 million in Wrapped Ether without posting the required collateral.&nbsp;



The Axie Infinite Ronin bridge attack, disclosed in March, involved a months-long phishing campaign to acquire private keys associated with its multisig wallet, which resulted in some $625 million in crypto stolen (both incidents valued at the time of the attack).



But Sam Sun, head of security at digital asset investment firm Paradigm, explained in a Twitter thread that Nomad’s thieves didn’t need to know anything about the Ethereum programming language Solidity to make off with user collateral.



<h3>Rari Capital hacker returned to raid Nomad</h3>



Nomad’s developers had accidentally pushed a routine upgrade which told the protocol to process any transaction with the default root hash of “0x00,” where usually blockchain networks require a unique and specific root as proof that the transaction is valid.



This meant Nomad would effectively approve any transaction submitted to the protocol. After an attacker realized and initiated large illicit transfers, other users simply copy-pasted their transaction script and replaced the receiver address with their own, explained Victor Young, chief architect at interoperability network Analog.



To Young, a key advantage of smart contract platforms, like the ones powering Nomad, is that they are Turing-complete systems. They can compute &#8220;virtually everything a modern digital computer can do from a mathematical standpoint,&#8221; Young said.



&#8220;Unfortunately, this introduces countless and unknown attack vectors that open the smart contract to hacks,&#8221; Young told Blockworks. &#8220;When you combine this with lax developers that fail to implement a robust set of testing mechanisms, you get the ridiculous meltdown that we are currently witnessing.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Nomad exploit onchain activity, visualized. <a href="https://t.co/WqjcbQfWKW">pic.twitter.com/WqjcbQfWKW</a>&mdash; Hsaka (@HsakaTrades) <a href="https://twitter.com/HsakaTrades/status/1554254701994156033?ref_src=twsrc%5Etfw">August 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Young prescribed other blockchain platforms end-to-end tests and repeated code audits to help mitigate risk of this happening elsewhere.



Blockchain security firm PeckShield <a href="https://twitter.com/PeckShieldAlert/status/1554350737957998592" target="_blank" rel="noreferrer noopener">reported</a> around 41 addresses had raided Nomad, a mixture of Wrapped Bitcoin and Wrapped Ether alongside stablecoins DAI and USDC.&nbsp;



Notably, the same address associated with the Rari Capital <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/" target="_blank" rel="noreferrer noopener">hack</a> in late-April was said to have pilfered $3.4 million in cryptocurrency. Less than $12,000 remains in Nomad’s smart contracts, down from more than $190 million before the raid, per <a href="https://defillama.com/protocol/nomad" target="_blank" rel="noreferrer noopener">DeFi Llama</a>.&nbsp;



The Nomad incident is now the third-biggest hack of the year, behind Wormhole and Ronin. It’s unclear what’s next for the firm.&nbsp;



Both Wormhole and the Axie Infinite teams raised venture capital in a bid to make both their users and protocols whole following their respective hacks. The company told Blockworks that its goal is to identify the accounts involved and ultimately trace and recover crypto.



Nomad also said that &#8220;many white hat [hacker] friends&#8221; had reacted quickly to withdraw and safeguard some of the funds, and directed its community to follow its Twitter account for instructions on how to return the stolen money.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Nomad Bridge Funds Recovery Process Dear white hat hackers and ethical researcher friends who have been safeguarding ETH/ERC-20 tokens, Please send the funds to the following wallet address on Ethereum: 0x94A84433101A10aEda762968f6995c574D1bF154 <a href="https://t.co/UF623JSZ8u">pic.twitter.com/UF623JSZ8u</a>&mdash; Nomad (⤭⛓🏛) (@nomadxyz_) <a href="https://twitter.com/nomadxyz_/status/1554679735006859264?ref_src=twsrc%5Etfw">August 3, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



This article was updated at 4:09 am ET, August 3, to include Nomad&#8217;s statement.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Nomad Token Bridge Raided for $190M in ‘Frenzied Free-For-All’

Jack Kubinec

<div id="highlights-block_62e30a11f6d23" class="highlights">
 <ul>
 <li>The chain is a layer-2 optimistic rollup that financially rewards “guards” for verifying transactions</li>
 <li>“Rather than deploy your dapp on ten different chains, why not deploy it on the bridge protocol that’s already connected to every chain?” Synapse tweeted</li>
 </ul>
 
</div>



Crypto builders are rushing to <a href="https://cms.blockworks.co/bridge-protocols-race-to-win-consumer-trust/" target="_blank" rel="noreferrer noopener">restore trust in bridges</a> as cross-chain hacks have cost crypto users nearly $2 billion this year. But the Synapse Protocol hopes to win over disaffected investors by getting rid of bridging altogether.



Synapse Chain, announced today, would create a single-chain solution to cross-chain swaps. In theory, the chain could lower costs and increase security.



At a basic level, cross-chain bridges are protocols that transfer information between blockchains. The most common bridge use case is moving cryptoassets between chains. In that case, the bridge holds a user&#8217;s assets in a smart contract while deploying a “wrapped” IOU asset on the bridged chain.



Synapse Chain would do away with asset wrapping by creating a blockchain directly compatible with different cryptoassets, Synapse explained <a href="https://synapse.mirror.xyz/L6dBb7aXIJ1Ll5_sxP2bIJxVEYNd43ZzIV6dRylQJxw" target="_blank" rel="noreferrer noopener">in a blog post</a>.



For instance, if a user purchased hypothetical token XYZ on the Ethereum network, she could potentially use a Synapse-powered decentralized exchange (DEX) to directly convert ETH to XYZ without bridging tokens, saving on gas fees and increasing security.



Synapse’s “single execution environment” is built on Ethereum but theoretically is compatible with any blockchain.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">3/ By leveraging Synapse’s messaging system and bridge, Synapse Chain will become the organizational hub of all cross-chain activity. Rather than deploy your dapp on ten different chains, why not deploy it on the bridge protocol that’s already connected to every chain? <a href="https://t.co/XqZrLE8mSM">pic.twitter.com/XqZrLE8mSM</a>&mdash; Synapse Protocol (@SynapseProtocol) <a href="https://twitter.com/SynapseProtocol/status/1552665932027334657?ref_src=twsrc%5Etfw">July 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The layer-2 uses optimistic proofs, where all transactions are assumed to be valid pending fraud claims from so-called guards.&nbsp;



Synapse believes optimistic verification will help the chain avoid adding to the nearly $2 billion in assets stolen from cross-chain protocols this year. Many hacked bridges held assets in multi-signature wallets that went light on the “multi.” <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">The Harmony Horizon bridge</a>, for instance, had five keys, only two of which needed to be compromised by the hacker.



An optimistic system requires every validator to approve transactions, as every guard tacitly verifies data when it does not submit an allegation of fraud. Synapse incentivizes guards to do their jobs by confiscating their SYN governance tokens when faulty transactions are marked valid, a mechanism known as slashing.



SYN jumped roughly 40% after the Synapse Chain announcement, trading around $1.70 Thursday afternoon.



Synapse’s optimistic rollup sequencer will initially be run in-house, though the protocol hopes to follow other layer-2s toward decentralization.



Still, <a href="https://vitalik.ca/general/2021/01/05/rollup.html" target="_blank" rel="noreferrer noopener">optimistic rollups have been criticized</a> for the tradeoffs inherent to the use of fraud proofs, such as a relatively long withdrawal period to move funds to the Ethereum mainnet, and Synapse is not the only team rethinking bridges. 



Axelar and LayerZero are other major players in the post-bridge space. In a Telegram message, LayerZero CEO Bryan Pellegrino called the protocol “neither a bridge nor a blockchain” that moves assets directly between contracts.



Similarly, the Synapse Chain, which is expected to go live on a public testnet within weeks, doesn’t necessarily require assets to be bridged at all.



“A lot of the assets won’t have to be sent into the rollup, they can live on a chain and the messaging system will attest to their value,” said Synapse’s chief operating officer Max Bronstein.



“If you trust the security of the messaging system, [then] you trust that the asset in the rollup is the same as the asset on the native chain.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Synapse Chain Eyeing Bridgeless Asset Swaps

<div id="highlights-block_62d8dff24d48f" class="highlights">
 <ul>
 <li>The announcement represents the first actualized zero-knowledge bridge</li>
 <li>The company says the bridge will be cheap, scalable and capable of performing all the same functions as Uniswap</li>
 </ul>
 
</div>



After a flurry of <a href="https://cms.blockworks.co/tag/ethereum/" target="_blank" rel="noreferrer noopener">Ethereum</a> security-oriented so-called “rollups” were unveiled recently, another layer-1 blockchain has decided to throw its hat in the ring.



Syscoin, a “dual-layered blockchain” merge-mined with <a href="https://cms.blockworks.co/tag/bitcoin/" target="_blank" rel="noreferrer noopener">Bitcoin</a> and running Ethereum-compatible smart contracts, is launching a zero-knowledge cross-chain bridge. The bridge, dubbed ZKCross, will have minimal fees and will facilitate cross-chain decentralized exchange, Syscoin told Blockworks. It is expected to be ready to demonstrate in September.



<a href="https://cms.blockworks.co/cross-chain-bridge-thefts-top-1b-in-2022/" target="_blank" rel="noreferrer noopener">Hackers have stolen</a> more than $1 billion from cross-chain bridges in 2022, leading to a proliferation of proposals meant to put investors at ease when moving assets between chains. The cross-chain bridges hacked in recent years employed multi-signature or multi-party computation (MPC) to validate their trades.



Syscoin’s zero-knowledge mechanism operates an off-chain automated market maker (AMM) that avoids exploitable consensus protocols, and can be used to manage liquidity and trading across multiple chains.



The accuracy of the transactions are verified with a zero-knowledge proof — essentially a fast and private way to authenticate data — before a bundle of transactions are rolled up and compressed to be settled on Syscoin’s base layer.



Syscoin believes the bridge technology allows for economies of scale — with a worst-case security scenario of the AMM going offline and users being forced to exit to the base layer.



“If it’s not this bridge, someone else will release a zero-knowledge bridge and that’ll be the bridge solution everyone is using. I really think this is where things are headed,” <a href="https://www.linkedin.com/in/jagdeep-sidhu-2a7bb76b/?originalSubdomain=ca" target="_blank" rel="noreferrer noopener">Jagdeep Sidhu</a>, lead developer at Syscoin, told Blockworks.



Helping the transition is the (relative) cheapness of zero-knowledge bridging. Sidhu says the only cost to bridge users will be that of their own CPU.



Zero-knowledge technology still has its shortcomings — a lack of decentralization being one of the most prominent. In essence, investors trade scalability and low cost for the risk of censorship.



“All the rollups are centralized right now,” Sidhu said. “We’ll start with a centralized sequencer, but the goal is to create a decentralized sequencer down the road.”



Syscoin hopes to create a zero-knowledge <a href="https://cms.blockworks.co/tag/evm/" target="_blank" rel="noreferrer noopener">Ethereum virtual machine</a> (EVM), the much-hyped proof system for Ethereum smart contracts, like the <a href="https://cms.blockworks.co/polygon-unveils-zkevm-the-holy-grail-of-scaling/" target="_blank" rel="noreferrer noopener">zkEVM protocol</a> launched Wednesday by Polygon. 



Sidhu does not believe anyone in crypto has yet created a “proper EVM” but emphasized that all protocols will need to move into the space eventually.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">

Syscoin Takes ‘Zero Knowledge’ Approach To Prevent Bridge Hacks

<div id="highlights-block_5af1046aad9e9854b869d8872e94239c" class="highlights">
 <ul>
 <li>“You should be scared of bridges. There’s a huge risk profile,” the head of DAOs at Alliance said</li>
 <li>DeFi bridges create trade-offs between simplicity, decentralization and cost</li>
 </ul>
 
</div>



Bridge protocols, designed to offer relatively seamless transfers between different blockchains, have been struggling to attract users as cryptocurrency markets continue to churn largely sideways.&nbsp;



Multichain, the largest such cross-chain bridge, has seen its total value locked (TVL) shrink to under $2 billion from $7 billion in March, according to crypto data firm DeFi Llama.



As competition for users intensifies, DeFi platforms are jockeying to become the preferred cross-chain protocol investors wary of bridges — which have wiped out <a href="https://cms.blockworks.co/cross-chain-bridge-thefts-top-1b-in-2022/" target="_blank" rel="noreferrer noopener">more than $1 billion in 2022</a>, largely via avoidable hacks.&nbsp;



Cross-chain bridging proliferated during the 2021 <a href="https://cms.blockworks.co/what-is-yield-farming-what-you-need-to-know/" target="_blank" rel="noreferrer noopener">yield-farming</a> bonanza. Will Robinson, the head of community at digital assets-focused investment manager Alliance, said consumers ought to do their research before using bridges.



“You should be scared of bridges,” Robinson told Blockworks. “There’s a huge risk profile. They’re still new, they break for unexpected reasons, and you don’t know what you’re getting into.”



<h3>Alternative bridging solutions</h3>



Osmosis recently partnered with the decentralized network Axelar on a “one-click” bridge that runs on Ethereum. The cross-chain protocol’s security lies in its decentralization, according to Sergey Gorbunov, co-founder of Axelar.



“Other bridges have permissioned nodes that participate in the system, but Axelar requires no trust for liveness or safety,” Gorbunov told Blockworks. “Even if people can’t operate their machines, Axelar still works on smart contracts.”



Permissioned bridging was largely to blame for the $625 million Ronin Bridge exploit, where multiple validators securing the Axie Infinity bridge were housed by the company. Axie has since increased and further decentralized its validators.



Axelar delegates most bridging legwork to the protocol, so all consumers see is assets moved from one chain to another — regardless of swaps on the back end.



With bridges receiving <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">lots of bad press</a> in 2022, some DeFi (decentralized finance) platforms are hoping to do away with the technology altogether.



The decentralized exchange (DEX) Hashflow went on a media blitz this year advertising its “bridgeless” cross-chain swap protocol. Rather than having smart contracts perform swaps, Hashflow moves assets by having dedicated market makers agree on prices.



“Mint-and-burn bridges can only generate representational assets escrowed by the underlying chain,” Varun Kumar, CEO of Hashflow, said in an email. Hashflow uses a “request-for-quote” model where market makers set prices and “off-chain components handle the gnarly parts where slippage and MEV would be introduced.”



Dominic Williams, founder of the protocol Internet Computer, believes bridging protocols like Axelar and Hashflow are not decentralized enough.&nbsp;



“If you have a centralized entity that’s taking funds, sooner or later things are gonna go wrong and you’ll get hacked,” Williams said to Blockworks. “Bridges require a trusted operator, so you get the same old problems.”&nbsp;



With wrapped tokens, “you’re basically asking the bridge to look after your money,” Williams said.



Wrapped assets are a common bridging practice where a protocol holds onto an investor’s original assets while providing an IOU to be swapped on different blockchains. Security breaches cause wrapped assets to lose their value. After the Wormhole hack, a <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/" target="_blank" rel="noreferrer noopener">$320 million bailout</a> was needed to save Solana protocols that accepted wrapped ether as collateral.



Williams said his Internet Computer network will allow asset movement without bridges through an innovation called chain key cryptography — the splitting of validator keys into pieces to make a blockchain publicly accessible.&nbsp;



Internet Computer received over $100 million in funding from venture capital firms a16z and Polychain Capital in 2018 — before a 2021 market downturn stripped the project’s token of 95% of its value in just two weeks.&nbsp;



Internet Computer says its bridgeless protocol will soon integrate with Bitcoin, though the company has not provided a specific date.



Vitalik Buterin, co-founder of Ethereum, <a href="https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8/" target="_blank" rel="noreferrer noopener">warned</a> cross-chain bridges would have trouble keeping assets safe early this year. Security will likely remain an inherent risk investors take when moving assets between chains, but DeFi is a young industry, industry participants say.&nbsp;



In each of this year’s major bridge hacks, “protocols broke for way dumber reasons” than Buterin imagined, Robinson said. As DeFi matures, <a href="https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game" target="_blank" rel="noreferrer noopener">fake job offers</a> will be less viable means for exploiting consumer wallets.



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your email every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
 
Want alpha sent directly to your inbox? Get degen trade ideas, governance updates, token performance, can’t-miss tweets and more from&nbsp;<a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">Blockworks Research&#8217;s Daily Debrief</a>.
 
Can&#8217;t wait? Get our news the fastest way possible.&nbsp;<a href="https://t.me/blockworks_news" target="_blank" rel="noreferrer noopener">Join us on Telegram</a> and follow us on <a href="https://news.google.com/publications/CAAqBwgKMPyTxgswn6_dAw" target="_blank" rel="noreferrer noopener">Google News</a>.
<hr class="wp-block-separator">