Scaling Collateralized BTC Bridges

Bridging BTC is challenging. Bitcoin lacks smart contracts, thus eliminating the ability to verify or react to events on other chains.

Why is this an obstacle? When bridging, we aim to lock BTC on Bitcoin and mint a wrapped BTC token on, say, Ethereum. While the wrapped BTC token exists on Ethereum, the BTC should remain locked on Bitcoin. Whenever a user desires to redeem wrapped BTC, the BTC on Bitcoin should be unlocked. Any changes in ownership should also be reflected (if Alice sends Bob wrapped BTC, Bob should be the one who can claim the BTC on Bitcoin).

Currently, the most widely adopted solution to this is the reliance on a trusted bridge operator. A custodian that holds BTC locked and unlocks it whenever required. It is strikingly similar to how banks hold custody of gold. This brings up the question: Is it genuinely BTC DeFi if your BTC bridge is CeFi?

Economically Secure, Collateralized BTC Bridges

Five years ago (7 June 2018), we published a paper describing a new type of bridging mechanism, tailored for BTC: Economically secure bridges, titled “XCLAIM” (https://eprint.iacr.org/2018/643).

(Fun fact: this was even before BitGo announced the centralized wBTC bridge).

Rather than trusting a centralized custodian, the bridge would be managed by a decentralized network of operators over-collateralized in assets like ETH or stablecoins. If operators lose or steal BTC, collateral is used to reimburse users. This model is “economically trustless,” not too different from the design of multi-collateral stablecoins like DAI — yet retains the critical property of physical redeemability against the underlying BTC.

In summary:

• Anyone can become a bridge operator.
• Operators (“Vaults”) lock collateral in a smart contract on Ethereum (e.g. ETH, USD stablecoins,…).
• Users deposit BTC with Vaults to receive a BTC-backed ERC-20 token on Ethereum.
• If the Vaults steal or lose BTC, the smart contract slashes the collateral and reimburses users.
• A BTC light client deployed as a smart contract on Ethereum (“BTC-Relay”) verifies the correct behavior of users and Vaults on Bitcoin.

As long as the collateral is worth more than the BTC locked with operators and the BTC-Relay keeps up to date with the Bitcoin mainchain, holders of BTC-backed wrapped tokens have the following guarantee:

“I can retrieve my BTC, or, in the worst-case scenario, I will be reimbursed in collateral (ETH, USD stables, …) that I can sell for BTC on an exchange”.

For a visual representation of the protocol:

For an in depth but ELI-5 explanation, see this slide deck from PizzaDay Prague 2023.

The Catch? Capital (In)efficiency

As always, there are trade-offs. The amount of BTC that can be bridged has an upper limit — the amount of collateral locked by Vaults. Locking collateral incurs a capital cost — these funds could be used elsewhere to earn yield, so the bridge must generate enough revenue to make it worthwhile for Vault operators.

Apart from implementation complexity, the challenge of capital efficiency is why centralized BTC bridges still dominate the market. Keep Network’s tBTC v1 was the first to experience this firsthand: the first production deployment of the collateralized BTC bridge model on Ethereum couldn’t compete with wBTC and was eventually shut down, favoring a statistical security model (honest majority assumption among a large set of operators).

The struggle of tBTC v1 since then has often been cited as evidence that collateralized BTC bridge models cannot work. An unfortunate outcome for BTC.

Capital efficiency is crucial for the success of collateralized bridge models. Too little revenue for Vault operators means too little collateral will be locked to cater to the needs of BTC-hungry DeFi protocols. Highly competitive APRs on L1 assets and stablecoins in DeFi protocols, as well as native staking yield, were long considered insurmountable hurdles — either the bridge would be too expensive for users, or it would have to achieve massive volumes, multiples of wBTC.

Over time, three solutions to this problem were identified:

1. Avoid collateral and rely on statistical security models (tBTC v2).
2. Find a way to re-use the collateral to earn extra revenue (Interlay v2).
3. Eliminate the collateral requirement altogether (will need a BTC fork).

Collateralized BTC Bridges 2.0–5 Years Later

At Interlay, we focused on the second option and tried to find ways to solve capital efficiency without compromising on economic security. Ultimately, it was a combination of years of research and novel developments in DeFi that provided the solution:

Re-use Vault collateral for (a) L1 PoS (re)staking, (b) lending protocols, and (c) other yield-bearing positions.

Re-using L1 Stake and Liquid Staking as Collateral

Wait, what? Restaking? Indeed, while it wasn’t called this in 2020, re-using staked L1 assets such as ETH, DOT, etc., as collateral to secure BTC bridges was indeed one of the most promising solutions for solving capital efficiency. Bridge operators would no longer have to choose between L1 staking and bridge rewards and would be able to secure and earn from both protocols. A win-win solution.

However, a challenge that “blocked” deployment of this early “restaking” solution in our eyes back then was the long unstaking time — or the absence of unstaking in the case of Ethereum. A user receiving staked L1 tokens as reimbursement in case of a bridge failure should be able to sell them for BTC — at least that’s the promise of the collateralized bridge model. Waiting for 30 days (e.g. Polkadot) or months (Ethereum before the Shanghai fork) to unstake the L1 asset first… well, that’s not really ideal. Of course, one could argue that the user could retain the staked L1 asset and earn staking yield — perhaps indeed a sufficiently acceptable option in practice — but at the time it was dismissed as too high risk.

Hence, it wasn’t until the rise of liquid staking that this solution became practical. Liquid staking solved the liquidation issue: as long as there was sufficient liquidity on exchanges (e.g. ETH/stETH pools) victims of a BTC bridge failure would be able to sell the slashed liquid staked collateral to re-purchase BTC.

In 2022, Interlay’s experimental version of the collateralized BTC bridge (“Kintsugi”) adopted LKSM (a liquid staked version of the Kusama PoS token) as Vault collateral, marking the first practical deployment of “re-staking” in practice (https://kintsugi.subsquare.io/democracy/proposal/74).

Using staked L1 assets as bridge collateral also offers some interesting security benefits. When we bridge two chains, we implicitly assume both systems operate securely (why else would we be bridging between them?!). By relying on e.g. Ethereum L1 stake to secure the bridge, we (partially) inherit the security of Ethereum itself. Why is this great? Because instead of introducing a 3rd party security assumption, we get very close to trusting only Bitcoin and Ethereum — and that’s as good as it can get for a bridge.

While liquid staking as bridge collateral is not quite the same as having Ethereum validators secure the bridge (we incur additional protocol risk from e.g. Lido or other liquid staking solutions), it does bring the bridge pretty close to inheriting ETH PoS security. A very promising avenue for future work that merits its own blog post (WIP, soon™).

Lending Out Collateral

Another avenue that can be used in parallel is integrating the bridge with lending protocols. The concept is simple: allow Vaults to lend out their collateral (e.g. USD stablecoins) to earn extra revenue. If Vaults lose BTC, the victims receive the lending position and can withdraw or keep it to continue earning lending income. When using pooled lending protocols like Aave or Compound that offer tokenized representations of lending positions, we can create markets between the lending positions and the underlying asset to reduce the friction of bridge liquidations, i.e., enabling the victims to easily sell the lending position even if the utilization of the pools is too high to fulfill a full redemption.

This approach is particularly useful when using stablecoins as bridge collateral. Considering that collateralized bridge models, similar to multi-collateral stablecoins like DAI, should aim for a diverse set of collaterals, a mix of liquid staking/restaking and lending positions as collateral is beneficial.

Other, Exotic Collaterals

We can continue the game of collateral re-utilization and introduce LP-tokens into the mix. While these should likely be considered “higher risk” than liquid/restaking and lending positions, LP tokens may provide interesting financial properties to Vault operators. For example, instead of supplying native USDT as collateral or a USDT lending position, a Vault might choose to use a USDT/USDC LP StableSwap position if the operator believes it will generate more yield. Similarly, structured products such as options, futures etc. may be even more interesting — and again, mandate their own blog post (WIP, soon™).

Don’t cut corners with endogenous collateral

Before we wrap up, a word of caution. Collateralized bridges have a lot of similarities to collateralized stablecoins. And just like for stablecoins, there are a few mechanisms that seem very attractive but introduce massive significant protocol risk.

Endogenous collateral means using the native token of the bridge as collateral.

Quoting the seminal Stablecoins 2.0 paper (co-authored by Interlay co-founder Dom):

“The price of endogenous collateral cannot be modeled exogenously due to endogenous feedback effects between stablecoin usage and collateral value. Its value is derived from a self-fulfilling coordination of ‘confidence’ between its participants. For instance, in a crisis of confidence, if expectations of stablecoin holder demand are low, then the value of the endogenous collateral should be low, which will further shake confidence in the system and demand”.

What does this mean? If something goes wrong with the bridge, e.g. a large number of Vaults fail and lose/steal BTC, large volumes of the collateral asset are liquidated and land on the market. A big failure of the bridge can result in a confidence crisis in the system with potentially severe implications on the price of the native token. In combination with the sell pressure from liquidations, the price may further decline, leading to even more liquidations as Vaults fail to uphold their collateral rations. This flywheel effect can quickly spiral out of control leading to a total collapse of the system.

A practical example of this scenario is the Luna collapse.

TLDR: using the native token as collateral can still work and go well if the ecosystem grows quickly, there is enough liquidity and the asset is used in many use cases beyond the bridge. The risks, however, should not be underestimated, especially in highly volatile markets such as crypto.

TLDR: “Where there’s a will, there’s a way”

Collateralized bridges are not dead.

We know how to solve the capital efficiency issue.

Decentralization will prevail.

Don’t take shortcuts.

PS

At Interlay we also worked on option (3) — “Eliminate the collateral requirement altogether” — and came up with interesting solutions that yielded first results but were not yet able to produce a universal solution for generalized BTC DeFi use cases. It seems that the best way forward is to design bridges/cross-chain custody solutions tailored to specific use cases. You guessed right, more in a separate blog, soon™