BlocksInform
Cross-chain bridges endured a torrid year in 2022, with more than $1.89 billion worth of users’ funds stolen via code vulnerabilities and other exploits. It’s a big problem and it becomes all the more concerning with the realization that state-funded North Korean hackers are believed to be the most prolific perpetrators of these incidents. According to data from The Block and Chainalysis, the so-called Lazarus Group was able to steal approximately $1 billion worth of users’ funds by hacking bridges and other DeFi protocols in the last year.
It’s fair to say that bridge vulnerabilities have emerged as one of the biggest security challenges to the wider cryptocurrency ecosystem, and especially DeFi. So it’s a problem that must be urgently addressed.
What Are Cross-Chain Bridges?
The blockchain industry is one that’s uniquely open and decentralized, and it has grown to encompass hundreds of different networks. Today, more than 100 independent blockchains exist, and they have no easy way of communicating with one another. Because of this, it’s impossible for someone on the Ethereum blockchain to interact with someone else using Bitcoin. So BTC, by far and away the most valuable crypto asset, cannot easily be used with the majority of DeFi protocols. Communication between blockchains is obviously desirable then, as it would unlock more liquidity for ecosystems, enable new use cases and spur the adoption of crypto.
The desire for blockchains to communicate led to the creation of cross-chain bridges, which are designed to enable interoperability between networks. As an example, the Wormhole bridge makes it possible for users to move cryptocurrencies and non-fungible tokens (NFTs) between various smart contract chains, such as Ethereum, Polygon and Solana.
Why Are They Vulnerable?
Unfortunately, the majority of cross-chain bridges have proven themselves to be extremely unreliable and therefore risky for users. They have emerged as one of the biggest targets for hackers, and they’re constantly being probed for weaknesses. And all too often, vulnerabilities are found, leading to millions of dollars worth of users’ funds being irrevocably lost.
The design of bridges varies, but in general they all use a similar mechanism in which the user will lock up assets on one chain (such as BTC on Bitcoin) into a smart contract. Once this is done, the bridge will then mint a “wrapped” version of that asset on the target blockchain (such as wBTC on Ethereum). The user is then able to use wBTC with any Ethereum based app, and can return the asset to unlock the original BTC at any time. In this way, the value of wBTC is always pegged to that of BTC.
Bridges are an innovative solution that enables interoperability between networks, but those locked tokens also make tempting targets for hackers, no matter if they’re secured by a smart contract, multisig wallet or third-party custodian.
Can Anybody Fix Them?
Cross-chain bridge security is one of the crypto industry’s most pressing unresolved challenges, but the good news is that progress is being made.
One of the most promising efforts to emerge this year is Pantos, a project started by the co-CEOs of Bitpanda, one of Europe’s biggest fintech platforms. Pantos, which launched in public beta in February, is developing a new kind of multichain token technology that will make it possible to transfer digital assets across protocols in a fully decentralized and trustless way.
Unlike bridges, Pantos is building a true multichain token system that will allow assets to exist on multiple blockchains and transfer between them freely. Key to this is Pantos’ new token standard for multichain assets, PANDAS, which stands for Pantos Digital Asset Standard.
Pantos is the culmination of years of research involving Bitpanda’s academic collaborators at TU Wien and TU Hamburg. Together with the researchers, it has formed a dedicated research group at the Christian Doppler Laboratory for Blockchain Technology and IoT that has been focused on network interoperability since 2018.
Pantos implements cutting-edge technology to offer interoperability across blockchains. It enables the native assets of all supported chains to be wrapped and used with Pantos, with each asset-backed 1:1 with the native token and locked inside a smart contract. The PANDAS-20 token standard is compatible with multiple blockchains (at launch, Ethereum, BNB Chain, Avalanche, Polygon, Cronos, Fantom and Celo are all supported) and allows developers to deploy assets on any of them, without maintenance work. In the future, it will also allow digital creators without coding skills to deploy their own multichain tokens.
While the design of Pantos is extremely innovative, the most encouraging aspect is the level of attention that has been paid towards its security. While no project can claim to be truly unhackable, Pantos has dedicated years of effort in partnership with some of the industry’s leading academics and scientists, testing every aspect of its multichain token ecosystem to minimize the potential attack surface. Leading these efforts are professors Stefan Schulte of TU Hamburg & Matteo Maffei of TU Wien, later has previously contributed a number of security improvements to Bitcoin’s Lightning Network. Together with a team of other researchers, he has reviewed the entire codebase of Pantos in order to identify and fix any vulnerabilities and exploits.
With its enhanced level of security, Pantos positions itself as a Layer-0 network for all major blockchains. It will become so much more than just a cross-chain bridge, providing the reliable foundational infrastructure for Web3 interoperability that the industry so badly needs.
Image by angelabeauchamp79 from Pixabay
