In perhaps the first decentralized online robbery, 190 million USD in assets was recently stolen from Nomad by a combination of black and white hat hackers. Even with the overall security risks of decentralized finance, cross-chain protocols like Nomad that help users move assets across blockchains seem to be particularly notorious as targets for hacking: the frequency and size of these attacks are significantly higher for bridges than for almost any other type of protocol.

There are many explanations circulating around about why cross-chain bridges are inherently less secure, including more vulnerability to 51% attacks, the complexity of multi-chain programs, a lack of a large enough developer community, and a large incentive for attackers in the form of locked token pools.

The very nature of connecting two chains is a big threat to security that will need to be addressed in the future. However,

recent bridge exploits have told us that the vulnerabilities being exploited right now are still in their infancy: 

the most basic problems of secure code and user authentication have been the main problem in practical attacks.

To understand what is going on with bridge security, let's recap a few of the most notable protocol hacks in the recent past.

 hackers took advantage of a flawed upgrade to skip a key verification step in sending messages, which meant that bridge funds could be drained by anyone as the protocol did not check the amount that a user transferred.

 hackers tricked employees into downloading malware, which allowed them to take control of a majority of validator nodes. This meant that they could fake withdrawals from the Ronin bridge, validating the transactions with the stolen keys.

hackers forged a valid signature for a bad transaction, allowing them to  mint wrapped ETH on Solana without locking collateral.

 hackers managed to fake deposits using a different deposit function call than intended, allowing them to withdraw BNB without locking collateral.

 hackers took advantage of a cross-chain smart contract flaw to make themselves the sole "keeper" of assets, essentially calling a function that would make them an admin using admin privileges granted by this same function.

From this, we can summarize a few key points:

We will use these to explore the current dilemma facing bridge developers.

To answer the main question here, past attacks were carried out mainly because:

Bridge protocols are a unique combination of factors where there is highly complex code to bridge different chains, there is a relatively small and new pool of developers, and there is a disproportionately high number of assets to protect.

It is no secret that it's almost impossible to guarantee that code is perfect. That's why developers have debugging procedures, updates to patch mistakes, and regular audits to try to get as close to that ideal as they can. However, the quality of audits and code reviews may not be as good as we hope simply because there aren't enough incredibly experienced individuals to account for every attack vector - we can see that the Poly Network hack used a very sophisticated route that is only clear to us after countless reviews. 

On top of this, bridging protocols rely on locking assets to mint new ones on a separate chain, which creates a large pool of tokens that can be withdrawn almost instantly: the entire TVL of a project can be drained with the same vulnerability, which means hackers can expect a particularly large payday when targeting these protocols. The more cross-chain activity there is, the more people will be willing to dedicate energy and resources to finding these tiny vulnerabilities. This means that even if the vulnerability is not due to the cross-chain nature of the protocol, the incentives mean that it is more likely that an attacker will find something to exploit.

Many different solutions have been proposed to bridging security, and out of them I believe that a stronger developer community and more redundancy will be the most important factors in combatting the problems we face now. This would have the potential to increase the quality of code and audits and introduce safeguards. @fmnxl suggests optional immutable contracts to avoid the risk of upgrades compromising security, arguing that safety can only be truly proven with sufficient time and volume; meanwhile there are also calls for a decentralized circuit breakers on asset withdrawals to combat exploits draining the entire protocol.

These measures certainly come with downsides: increasing developer engagement it is definitely easier said than done as true adoption takes time and incentives, redundancies will affect user experience and affect liquidity in the space, and none of these will guarantee a secure codebase no matter how much improvement there is.

Perhaps future innovation can provide a silver bullet for all our bridging problems, but for now the most established cross-chain projects are your best bet: they have the resources and teams to provide the most secure possible place to transfer your funds between chains, and the more they are tested the more trust one can place in them.

On a slightly different note, Vitalik argues against a cross-chain network in the first place. There are basic flaws with guaranteeing security across all chains on a cross-chain network, and although many of these problems have not been a significant part of previous exploits (as he rightly estimated), we will eventually have to combat them as well. However, this is another topic that can be pursued in other articles.

As of right now, bridge security is still the age-old game of cat and mouse, but the scale and number of attacks merits a constant reminder that these protocols in particular need to be thoroughly examined. Stay alive and always make sure to manage your risk when dealing with them.

Thanks for reading! If you want to learn more about this subject, here are some good resources:

Why do cross-chain protocols keep getting hacked?

Most people using any blockchain can tell you something about gas: the more computation needed to do something on-chain, the more money you pay to get it processed.

Reducing gas fees are a key value proposition in almost every chain that comes out today. On most websites you will see teams shouting about throughput/processing power many times that of Ethereum or Bitcoin. This is often because of shorter block time and bigger block size - how long it takes to confirm a block and how many transactions can be stored in each one. For an idea of the difference this makes, Solana and Ethereum are running an average of 2700 and 20 transactions per second as of the time of writing. The higher the throughput, the lower the average cost because there is more space for everyone.

Now you might wonder: why can't the Ethereum chain just increase block size and decrease block time to reduce gas fees? The answer is that they can, but just choose not to.

To understand this matter properly, let's have a quick refresher on how gas fees are calculated on Ethereum. The amount a user pays follows a simple formula.

Gas units measure how much processing power your transaction needs to be executed on-chain. This is multiplied by the sum of two things: the base fee - the minimum price per unit of gas for inclusion in the block - and the tip - the money sent to miners/validators to compensate them for including transactions. Both the base fee and the tip increase when many people are trying to send their transactions: base fee is calculated automatically by the network depending on the demand for block space, while higher tips ensure that your transactions are prioritized by a miner over other requests.

The higher the demand for a limited space in each block, the higher the gas fee you pay to get a transaction processed.

Why doesn't Ethereum just make more big blocks?

By increasing the available block space, gas fees can be reduced. However, this comes with the problem of decreasing security and decentralization.

When block size is increased, space and speed requirements for the hardware running a node become much higher. As a rough idea, a Solana validator node requires a minimum of 128 GB in RAM, a BSC validator node requires 64 GB, while an Ethereum validator node is expected to be able to run on a normal laptop, which has around 8 GB of RAM on average. The most powerful nodes in a network have a significant advantage when block size is large purely because of their computational advantage.

The biggest issue here is that if blocks are too large, a normal person will not be able to run a node.

Maintaining a block time around 12-14 seconds follows the same logic. It prevents miners from using more computational power to threaten the security of the network, with the network automatically setting the difficulty of mining a block to keep the block time at a set value.

One of the most well-known ideas in blockchain development is the Scalability Trilemma: most blockchains can only get two out of three key components in designing an ideal network. Traditionally, Ethereum has focused on decentralization and security. Other networks have a significant advantage in throughput, and for different applications there is not really a pressing need for the same level of decentralization, which gives them unique value propositions.

Increasing throughput and reducing gas fees are obviously crucial for mass adoption to occur, but the network in this case follows the Ethereum vision: this includes making sure that the barrier to entry for node operators is low in order to avoid centralization of power over the chain, which takes priority over reducing gas fees right away.

Today, a large part of development around Ethereum is focused on the scalability. Fortunately, this means that gas fees can in fact be reduced in the future. The use of Sharding and Layer 2 solutions are by now very well known additions to the existing network, allowing people to use the security of Layer 1 Ethereum with the speed and cost vastly improved.

Sharding has yet to be implemented and is another topic entirely, but from what we can see about gas fees on L2s there is a significant improvement already.

Optimism boasts gas fees between 10 and 50 times cheaper than Ethereum mainnet, using a combination of variables to calculate gas fees: an L2 execution fee and L1 security fee - the cost of executing the transaction in a L2 environment and the cost of publishing the transaction on Ethereum in a rollup batch. Details on why this is so much cheaper are touched on in a previous article, but essentially rollups give the ability to split the expensive validation on Layer 1 between many people as opposed to paying the entire fee yourself.

These solutions are not perfect: Arbitrum briefly had higher gas fees than Ethereum Mainnet during an onboarding event because of the sheer number of people trying to use their network. On another branch of development, multiple projects have recently announced their launch of zkEVMs to address the complexity of developing on a Layer 2 framework, which comes with its own tradeoffs. And of course, the highly anticipated Merge needs to go ahead before Sharding can begin to be implemented on Layer 1.

Anyone claiming that one solution is objectively better than another in web3 is often biased. However, through this short article hopefully we can see that there are solutions to any problem, and the tradeoffs made by Ethereum will not stop it from scaling in the future.

Gas fees offer protection for the network by preventing spam and incentivizing miners to participate in running a valid node, and yet it is a delicate balancing act between security and convenience - as with many other things in life. Gas fees are likely to always be a part of doing anything on-chain, but hopefully we can see a future where we can swap all the utility coins we could dream of for virtually no cost.

Thanks for reading! If you want to learn more about this topic, here are some articles I found particularly useful.

Gas fees: why doesn't Ethereum just make it cheaper?

Hear me out: you deposit 1 USD, and I give you a coin that you can use to redeem this 1 USD at any time. While you hold this coin, I can invest your 1 USD to earn extra money.

Even better: give me 1.5 USD worth of assets and I'll give you back a coin worth 1 USD. You can exchange this coin for your deposited assets at any time, but I'll charge you interest for lending you your 1 USD coin. Sounds fair?

These are intuitive examples of how USDC and DAI work respectively, two of the most popular stablecoin issuers in the markets today. At first glance, it doesn't make any sense why people would mint either token - sure, we all know how useful stablecoins are in acting as liquidity and a non-volatile asset, but there doesn't seem to be an obvious economic upside to minting a stablecoin yourself. 

In that case, why are there so many people minting them? USDC has a market cap of 55 billion USD, while DAI has a market cap of 7 billion USD.

The answer for USDC and similar coins (e.g. USDT, FRAX) is very simple: market demand for stablecoins allows minters to arbitrage a price difference.

If enough people want to hold USDC (for trading, earning yield, money transfers etc.), natural supply and demand will drive the price of USDC above 1 USD. An arbitrageur can then send 1 USD to Circle to claim 1 USDC, which they can sell to make an instant profit. If USDC is trading at 1.005 at this time, the arbitrageur makes 0.005 USD and adds to the total supply of USDC in the market. This works the opposite way, where if the price is now 0.995 USD per USDC, an arbitrageur can buy USDC on the open market and send that to Circle, for which they will receive 1 USD, making the same profit.

Hasu refers to tokens that work as above as 

, where "supply can closely track demand". This means that there will always be as many stablecoins of this sort as are needed in the market at any time: if more people want them, arbitrage will incentivize minting; if fewer people want them, burning is incentivized.

Note that if the confidence in the company supplying these stablecoins is low, the arbitraguer may be concerned that they cannot redeem 1 USD for every stablecoin they send back: if, for example, Circle declares that they don't have enough cash reserves to support redemptions on a 1:1 basis, there is no longer an arbitrage opportunity at this price. This can result in the price of a stablecoin de-pegging towards a value that reflects the company's ability to honor redemptions: if I can only get 0.8 USD for every USDC I send, I will only perform arbitrage when 1 USDC is worth less than that amount.

For a token like DAI, a minter essentially borrows the stablecoin with an over-collateralized loan. A user must lock up around 150% in excess assets and bears the risk of liquidation if these assets go down in price. There is also the need to pay fees in order to mint DAI, along with the opportunity cost of not earning yield on the underlying assets (although this is now changing, with protocols such as USDH allowing staked Solana to act as collateral).

The crucial thing to realize here is that the minting process does not support the same use case for the two types of stablecoins, and that the main goal of Maker is to provide a 

 as opposed to a token. There is no way to conduct arbitrage in a similar way to scalable stablecoins, and so the supply of these over-collateralized tokens will not rise in the same way when there is demand. 

Minting DAI lets you use money without selling the underlying asset, and this means you have liquidity without incurring capital gains tax. The main difference between doing this with DAI and borrowing USDC on a platform like Aave or a centralized exchange is that Maker can offer lower fees and less risk, as well as a decentralized version of these services. Aave's new stablecoin, GHO, functions in a similar way and also allows users to lend their collateralized assets while borrowing the native stablecoin. In this case, it is helpful to not think about minting DAI as providing liquidity to the market, but rather as a product of decentralized lending that just happens to be pegged to 1 USD. This of course opens up an avenue for decentralized payment options with enough adoption, but the underlying minting mechanism remains one of borrowing and lending.

Yes, if you want either one of two things: arbitrage or lending services. It's important to understand how stablecoins work because they are useful, but not everyone needs to know how to introduce them into circulation. On the other hand, knowing this will allow you to make the most of the opportunities offered, and perhaps come up with the next innovative stablecoin solution that can combine the worlds of decentralization and scalability.

Thanks for reading! If you found this article useful or interesting, below is a paper written by Hasu that goes into more depth about the mechanisms and use cases of DAI, as well as some innovative projects developing in the space.

Why would I ever mint a stablecoin?

Why should you learn about rollups? What are they, even?

Rollups are a type of Layer 2 scaling solution that many hope will form the future of Ethereum. 

A simple illustration describes Ethereum as a highway. The network is a road, and transactions are the people travelling along this path. If everyone drives their own car, the highway gets a lot of traffic jams, especially during rush hour. Rollups allow people to take the bus instead of driving, reducing the toll fees everyone pays and allowing traffic to flow a bit better. 

Some of the most important reasons more people should pay attention to rollups are as follows:

The reason rollups are becoming more and more important is that they allow for mass adoption and innovation. At their core, rollups built on Ethereum have the freedom to do (almost) anything they want while being backed up by the security and decentralization of the main network. This not only can solve issues of high gas fees, but may also offer the only way for web 3 to rival existing services on their own playing field. The best part? End users won't need to navigate any of this!

Rollups take data processing off-chain. Essentially, you take a bunch of transactions and get someone to sign off on it, saying that they believe the outcome of all of these transactions is X. So now, instead of enforcing all of these transactions on Ethereum, you just have to confirm X, saving a lot of expensive computation on-chain.

Let's add in our technical terms: we get our transactions on a platform called the Execution Layer (where everyone does stuff), and after we come up with our proposed outcome we send it to the Settlement Layer (where all these records are securely stored). The most popular rollups nowadays either use Optimistic rollups or Zero-knowledge rollups, which both work by allowing anyone to verify that outcome X proposed by the signer is valid, but in a computationally simple way.

The advantages of rollups come from the unique way this structure works. Rollup confirmation happens when you have your proposed outcome, and due to the nature of rollups we can have this very quickly. Settlement finality happens when the outcome is processed on the main network/settlement layer: this does not need to affect the initial rollup confirmation as long as the outcome is valid, and we ensure this because it is easy to check the proof that this is true. In other words, we get the benefits of incredibly fast processing on a rollup (execution layer), and the security of Ethereum behind it (settlement layer).

 Now we can start discussing the future. Note that rollups are still early in their development so we can watch out for innovations like these as they come out: the potential use cases are far more exciting than what currently exists.

Ben Jones, cofounder of the Optimism Foundation, talks about a "superchain" in an interview: imagine using any Layer 2 protocol without realizing that you are bridging between rollups. We have the potential to integrate all of these sidechains into one comprehensive user experience, getting access to all the advantages of application-specific chains and different rollup technologies while benefitting from the security of Layer 1 Ethereum. @apolynya has a great thread on application-specific rollups providing high throughput (i.e. great processing capacity) that goes more in-depth on the advantages here.

This can also change how tokenomics work. In a chain where there is no need for token value to secure the system (see Proof-of-Stake and all the potential attacks), we might see more innovative uses than just stacking up a dollar value. On the other side, this also provides a way for chains to be economically sustainable in the long run. Sanjay Shah discusses an issue with Solana where fee revenue does not match the amount paid to validators for securing the network, which may affect the growth of the system's market cap and thus security.

He suggests that problems such as this can be solved by "outsourcing" the security issue to a large Layer 1: we can see how this might work for any upcoming projects who want to start a chain - if they can focus on building a service without constant concerns about market cap or malicious attackers taking over the network it opens up a lot of developmental freedom. When we can start delegating the security of a network, particularly one as big as Ethereum, we can start exploring the more specific environments some projects need to thrive.

This article acts as a small introduction to rollups and their future, and so I haven't gone into incredible details on many aspects of the technology (and may have oversimplified a few things). Rollups are undeniably complicated, and that deters many people from engaging meaningfully with them, but I hope that with increasing awareness about what they can do we will see more people making an effort to learn and try them out for themselves. This is especially important as the more people are interested in this technology, the faster it can develop and live up to its full potential.

There's a lot more to cover, especially in how rollups tie into Ethereum's transition to Proof-of-Stake, but that is a topic for another day. For now, that's a wrap.

Thanks for reading! If you found this interesting, you'll like these articles:

Rollups: flavours of the future

In an on-chain environment, the pursuit of Maximal Extractable Value (MEV) seems to create a lawless land where profit is king: if there is an opportunity for arbitrage, there is a bot hunting it down. And yet the multi-tiered process of getting a transaction onto the chain creates interesting power dynamics in who gets the final say on making money. Let's break this down with a quick recap of the parties involved in Proof-of-Stake (PoS) MEV.

 find on-chain opportunities to make a profit through arbitrage, liquidations, or any strategy that extracts value from transaction ordering.

receive transactions from searchers and create blocks with the maximum amount of value. As of now, miner/validator and block builder are one and the same in most cases, but organizations like Flashbots are pioneering MEV boost, which allows for proposer/builder separation (PBS) - anyone can be a block builder in the future and propose a solution with "[optimized] MEV extraction and fair distribution of rewards" to a validator.

propose blocks to be added to a chain, earning staking rewards and any bribes offered by interested parties (most likely block builders in the future).

submit transactions that lead to the creation of MEV, but importantly have power in deciding which validator to stake assets with.

In a highly competitive environment, a large majority of searcher profit is paid to the block builder/miner in order to gain the priority status needed to take advantage of an opportunity. In PoS this is still true: when there are many parties exploiting the same transactions, the one willing to pay the highest fee wins the window of opportunity.

A similar argument could be applied to the block builder stage if PBS is implemented, although there is much more leeway due to a wider range of blocks that could be built: some also point to a reputation system where certain block builders could develop a standing by only taking certain transactions (e.g. reducing the number of sandwich attack bundles), which could result in preferential treatment from validators with an interest in creating a block more in line with their ideals. This may be less likely to occur due to pre-confirmation privacy: essentially, proposers are not allowed to see the contents of a block until after a block is selected to prevent them from stealing the work of a block builder.

Validators seem to be at the top of this food chain, with everyone fighting to get their approval. Flashbot devs point to a significant profit in ETH 2.0 by simply approving blocks that searchers and builders put their efforts into: “MEV can increase validator rewards by 75.3%, or give an APR of 12.86% rather than a non-MEV APR of 7.35% from staking eth.” However, the point that people now turn to is that validators answer to users because of increasingly liquid staking.

The more staking assets a validator controls, the more likely they are to be selected as the block proposer, and thus the more they will be able to earn from enabling MEV. Ali Sheikh proposes MEV Profit Sharing Validators that distribute these MEV rewards to attract users, while Matt Cutler examines the idea of a wallet that can pay users for submitting transactions (which creates MEV). This comes as a natural progression that validators in a healthy competitive environment will have to find a balance between short and long-term profit.

A further interesting point this may influence is competition between chains. The more users and transactions on a chain, the more MEV is created. This, in turn, benefits everyone from searcher to validator, and due to the power dynamics of staking high user activity this will likely result in users earning more: either from supplemented staking rewards or direct payments. The former encourages people to stay on this dominant chain for the superior staking rewards (that are not due to overly high inflationary distributions), while the latter encourages usage of the chain.

If the value flows back to the community, there is an opportunity for a positive feedback loop where staking or interacting is rewarded more than any other chain, bringing traffic to the original chain. The caveat is that there is likely to be an equilibrium between these increased rewards and the dilution of rewards distribution due to a higher number of stakers, but even just the effect of reduced selling pressure from more staked assets can positively affect the chain's valuation, which can further benefit users of said chain.

So who really wins here? Users are definitely up there, as they finally get a slice of the MEV pie. Validators and block builders win as well as the more transactions there are, the more money they can make. But I would argue that the searchers are an underrated winner in this case. In a competitive environment, searcher margins are already thin, but any large increase in activity opens up far more opportunities for arbitrage that can allow searchers to gain an advantage. The nature of searching is such that it would be best if every other searcher gave up tomorrow, but hopefully the future finds a way for everyone to have some space in the dark forest.

Thanks for reading. If you found this topic interesting, here are some great resources to learn more!