Apr 1, 2022
Teleport: Blockchain bridges — trade-off between security and functionality
If you have spent even a day on the internet looking into the cryptocurrency scene, chances are you would have come across some warnings or best practices on protecting your crypto assets. Best believe this is not a drill as the crypto industry is still in its nascent stage and is no stranger to scams and hacks.
Infact, a quick google search on the latest crypto news will probably headline the most recent one yet — an exploitation of Axie infinity’s Ronin bridge which reportedly led to the loss of approximately $625 million in Ether and USDC.
What then does this mean for blockchain bridges?
Blockchain bridges: Loopholes and Mitigation
According to a statement from Flora Li, head of Huobi Research Institute, the Ronin bridge hack “reflects the continuing challenges that blockchains and operators face in balancing user experience and security”. Some believe the hack fundamentally reveals how Proof-of-Stake (PoS) chains still struggle, with speed and energy efficiency prioritized over security.
Blockchain bridges have been hacked in the past but this is quite different. Root cause analysis of many of the previous blockchain bridge hacks has been traced to the exploitation of smart contract bugs; however, this is a much more “classical” hack of private keys in a multi-key security architecture. This means that more than two-thirds of the required validator private keys were compromised; thus, gaining significant control of the bridge. This further emphasizes the need for trust-minimized bridging systems.
While this hack is certainly not the end of the world, particularly because the transparency benefit of blockchains is at play at the moment with forensic platforms like Elliptic vigorously tracking and investigating the transfer of the stolen assets, it is evident that that PoS chains need to leverage every tenable method possible to bolster security.
Additionally, the mere fact that the hack was not discovered until after a few days typically emphasizes the absolute necessity for monitoring and alert systems integrated with blockchain bridges. This would help blockchain networks quickly take proactive measures in mitigating (or minimizing) asset theft in the event of a hack.
Teleport bridge: Striking balance between functionality and security
Teleport Network facilitates cross-chain token swaps and asset transfers leveraging the Teleport bridge — powered by our XIBC cross-chain protocol. The XIBC cross-chain protocol enables communication through an efficient and verifiable relay-chain, thus, capable of support for both EVM and non-EVM chains.
Although the Teleport bridge continually undergoes numerous industry-standard security checks, the architecture and our cross-chain approach provides an additional layer of security benefits as highlighted below:
- Light-client approach: Our XIBC light clients are trustless, no middleman and zero-risk of private key leaks. The cross-chain packet is verified on the destination chain by two steps — block verification and packet merkle proof verification. Any forged or tempered cross-chain packet can not pass the verification to be executed on the destination chain.
- TSS nodes: Our TSS nodes, which are responsible for verifying cross-chain packets, are decentralized and hosted in TEE (Trusted execution environment). This prevents hackers from accessing keys if the system gets compromised. Furthermore, our TSS nodes are a subset of the Teleport chain’s validators which ensures XIBC clients share the same security infrastructure as the Teleport chain.
- Risk control: Every cross-chain transaction on the Teleport network is subjected to a robust monitoring and reconciliation system. By default, the network limits the amount possible in a single swap and sets a time quota for the swap to limit risk exposure in the case of a malicious hacker attempt.
Additionally, Teleport’s XIBC protocol is composable, which means more cross-chain approaches can be used (like zk-proof or fraud-proof verification) to mitigate cross-chain vulnerabilities in different scenarios.
In essence, Teleport’s approach to cross-chain communication innately takes into account many of the security lapses of bridging technologies and mitigates them from the get-go.
Concluding thoughts: Fixing the loopholes
Although there is nothing pleasant about blockchain bridges being exploited, it is almost a given that these kinds of hacks will continue to happen, opening up conversions around better ways for security. The onus rests on the entire blockchain community to continue to iterate, discovering better security implementations and taking a more proactive approach (rather than reactive) to preventing and minimizing hacking episodes.
Ultimately, the blockchain space has seen incredible progress over the past few years, and the future of cross-chain communication can only be better with trustless and decentralized cross-chain architectures.
Join the Community:
