By Heidi Wilder, Special Investigations Manager & Tammy Yang, Blockchain Researcher
Introduction
Recent questions have been raised about how bridges and mixers work both for legitimate business purposes and illicit financial transactions.
Although mixing services have been extensively analyzed for years, bridges are a newer concept that became popular in 2021. Bridges allow crypto holders to ‘move’ (or ‘bridge’) their assets between different blockchains. This allows them to hop from one chain to another and gain exposure to other networks.
We observed a sharp increase in cross-chain activities from Ethereum beginning in April 2021. The daily number of deposit activities to Ethereum bridges reached its peak in the Summer of 2021 and the highest single-day record of over 60,000 transactions bridging from Ethereum occurred on September 12, 2021.
This two-part blog post aims to explain what bridging is, why it has become so popular, and why bad actors are bridging over funds across networks.
What is a bridge?
A bridge is an application that uses cross-chain communication technology to enable transactions between two or more networks, which can be Layer 1s, Layer 2s, or even off-chain services. Simply put, a bridge allows crypto holders to transfer their assets from one network to another. For example, a USDC holder on Ethereum might want to transfer their USDC from Ethereum to Avalanche via a bridge application.
However, a bridge doesn’t move an asset between chains, it links the asset on one network to its representation (i.e. a wrapped version) on the other network. The cross-chain transaction is achieved via ‘locking’, ‘minting’, and ‘burning’ that accounts for the link between the representations on different chains. We’ll discuss exactly what these terms mean in the following two examples.
Let’s say Alice wants to bridge 100 ETH from Ethereum to another network called Network Other (a made up blockchain network) via a bridge application called Bridge (also made up):
- Alice deposits 100 ETH to the Bridge contract on Ethereum;
- The Bridge contract on Ethereum locks the assets and informs the other Bridge contract on Network Other; the asset cannot be accessed until the users requests a withdrawal;
- The Bridge contract on Network Other mints (creates) 100 tokens representing the locked ETH (i.e. wrapped ETH);
- The Bridge contract transfers the newly minted wrapped ETH to Alice’s address on Network Other:
Alice now holds 100 wrapped ETH on Network Other. Later, she receives 10 wrapped ETH from someone else. Now, her address balance on Network Other increases to 110 wrapped ETH. She decides to withdraw all back to Ethereum:
- Alice sends 110 wrapped ETH to the Bridge contract on Network Other;
- The Bridge contract on Network Other burns (destroys) the 110 wrapped ETH and notifies the Bridge contract on Ethereum;
- The Bridge contract on Ethereum validates the withdrawal request (e.g. whether Alice really owns 110 wrapped ETH on Network Other). If all checks out, it unlocks 110 ETH to Alice’s address on Ethereum:
How and when did bridging get so popular?
Bridging took off in 2021. Especially after April 2021, we saw cross-chain traffic from Ethereum increased exponentially — both in daily number of transactions and unique addresses deposited to the Ethereum bridges. We believe this upward trend is likely driven by one of the reasons below:
- Increase in the number of bridge applications. Wormhole launched the Ethereum-Solana bridge, Multichain (AnySwap) launched the Ethereum-Fantom bridge and Ethereum-Moonriver bridge, and Celer launched the cBridge in 2021.
- Increase in the number of new networks that can connect with Ethereum. Avalanche, Ronin, Arbitrum One, Optimism, and Solana were launched in 2021.
- Increase in the number of decentralized application (dApp) projects launching on chains other than Ethereum and incentivized usage of these systems.
Why do users bother bridging at all?
Normally, users want to bridge from one network to another because they want:
- Faster and cheaper transactions. For example, alt-Layer 1s like Polygon, Layer 2s like Arbitrum One and Optimism are the well-known scaling solutions to Ethereum.
- To use assets that are not native to the network. For example, users can gain price exposure to a currency like Bitcoin on Ethereum, with the help of bridge projects like Ren and Wrapped Bitcoin.
- To access a broader selection of dApps. A user might want to bridge funds from Ethereum to the Ronin Network to access Ronin-specific applications, such as their gaming dApp; since some dApps aren’t deployed on Ethereum mainnet because of its limitation on transaction speed and block size.
- To gain additional income from incentive programs. Many users choose to bridge because destination networks or projects on destination networks may send free tokens to members of their communities.
What’s happened since 2021?
A lot happened in 2021. Between July and November, many new dApps and new networks were launched. Bridging activities from Ethereum were at its peak during the time. Most of the bridges became quieter from Q4 in 2021. However, this was not the case for the Polygon PoS bridge — we saw strong and steady bridge traffic, in the number of deposit transactions, from Ethereum to the Polygon Network throughout 2021, which eventually led to Polygon PoS dominating cross-chain traffic in Q1 2022.
Figure 1 below shows the daily number of deposit transactions to Ethereum bridges. We theorize that the sharp spike around September 11, 2021 was driven by the launch of Arbitrum One.
Figure 1 Daily number of transactions deposited to Ethereum bridges since 2021.
Let’s take a look at bridge dynamics in deposit and withdrawal volumes in USD. Figure 2 below shows the daily deposit and withdrawal volumes in USD in Q1 2022. We believe that some sharp spikes in volumes were event-driven (e.g. launch of a new project, airdrop, incentive program, whale activity, bridge exploits, etc.)
- Top 3 in total deposit volume in Q1 2022 are AnySwap Fantom bridge (green, ~$8.4B), Avalanche bridge (pink, ~$7.8B), and Polygon PoS bridge (blue, ~$4B);
- Top 3 in total withdrawal volume in Q1 2022 are Avalanche bridge (pink, ~$10.5B), AnySwap Fantom bridge (green, ~ $6B), and Polygon PoS bridge (blue, ~$3.8B);
We also observed a very interesting fund movement pattern, especially with the AnySwap Fantom bridge, where large amounts of funds were moved to the Fantom network, and then withdrawn back to Ethereum mainnet after a very short period of time.
Figure 2 Daily deposit volume in USD to Ethereum bridges in Q1 2022
How safe are bridges?
As with most new technology, there are some risks to consider. For example, there are risks that users’ funds can be stuck during the deposit and withdrawal process, or they can be victims of cyber theft. When users decide to bridge an asset, they should also be aware of the underlying risks so that they can make more risk-driven decisions.
Theft Risk is the most common risk that can lead to bridge contracts losing part or all of the funds. Here are some problems that may lead to theft:
- Bugs in smart contracts. Programming or logical errors can have a serious impact on bridge security, creating opportunities for attackers to steal the locked funds from the bridge contracts.
The latest example is the Wormhole attack in February 2022 (details here). The attacker spotted a loop hole in the smart contract code, minted 120K Solana ETH without bridge approval and withdrew 80,000 ETH from Ethereum in Feb 02, 2022. Luckily, Jump Trading covered the gap by depositing 120K ETH back to the bridge contract on Ethereum.
Figure 3 Daily deposit and withdrawal volume in USD to Wormhole bridges
- Compromised custodians. Most of the bridge applications nowadays rely on external authorities to interact with the bridge and withdraw funds. They are the custodians of the locked funds — they can be trusted parties (e.g. AnySwap bridges) or a pool of validators bonded by stakes (e.g. Polygon PoS bridge and Ronin bridge). Then there is a risk that the custodians may be compromised or act maliciously.
On March 23 2022, the Ronin attackers compromised all four validation nodes run by Sky Mavis. Sky Mavis is the company who created the Axie Infinity game, Ronin Network, and the Ronin bridge. Together with the fifth validator (run by Axie Dao), which whitelisted all messages sent by Axie Infinity at the time, attackers gained control over the majority of the validators (5 out of 9).
The attacker then withdrew 173,600 ETH and $25.5 million USDC from the Ronin bridge on Ethereum without going through any verifications (more details here and here).
Figure 4 Daily deposit and withdrawal volume in USD to Ronin bridges
- Hostile Layer 1 miners/validators. If more than 50% of the Layer 1’s computing power or stakes are controlled by hostile miners or validators, they can attack bridges on chain and steal the locked funds. For example, they can revert a completed deposit transaction on Ethereum after assets are bridged to another network, which allows attackers to withdraw funds from the other network without depositing on Ethereum (more details here). Or, they can prevent bridge contracts getting updates from the other network, which may lead to major damage to user’s funds that are locked at the bridges.
These scenarios are unlikely to happen, but not impossible. In a worst case scenario, if assets locked at an exploited bridge were already bridged over from another network and used in DeFi applications, this may lead to a cascading contagion over multiple blockchain networks.
Bridge users should be aware that the loss by theft is usually not reversible.
What do we expect for 2022?
Given the explosion of bridges in 2021, we believe their popularity will continue to rise, especially as we are expecting to see developments in below areas:
- Bridging demand. As more networks and bridges launch this year, we expect to see more users wanting to bridge between networks;
- CEXs. More centralized exchanges (CEXs) will enable direct deposit and withdrawal to alt-Layer 1s and Layer 2s in 2022 (some already happened here, here and here).
- Bridge security. As more users willing to bridge, more crypto assets will be locked at the bridge contract — creating a honeypot effect, increasingly attracting hackers.
- Risk awareness. Many bridging decisions are cost-driven at the moment. We believe people have different risk appetites. However, there is a big difference between risk weighting choice of a bridge vs. choosing a cheap bridge solely because of the low fees.
It will be interesting to see, with more information and discussions around bridge security becoming available, if more risk-driven decisions would be made when it comes to choosing a bridge in the future.
Now that we understand what bridges are, why they’ve gained mass appeal, and what potential security concerns are with them, in our next blog post we’ll discuss the use of bridges by bad actors.
