L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our discord to suggest improvements!
Connext
...
Choose token
Renzo Restaked ETH (ezETH)
Wrapped Ether (WETH)
Tether USD (USDT)
USD Coin (USDC)
Dai Stablecoin (DAI)
Metis Token (Metis)
Alchemix USD (alUSD)Connext Amarok announced
2022 May 11th
The new, modular architecture for Connext Amarok has been announced.
Funds can be stolen if
- native AMBs that Connext uses allow for passing forged messages and this is not caught by Watchers,
- connectors to optimistic rollups (Optimism, Arbitrum) receive a fraudulent message within 7-day fraud-proof window (CRITICAL),
- a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).
Users can be censored if
Principle of operation
The bridge can operate in one of two modes, Optimistic or Slow. They differ in how the messages are sent between chains. In Optimistic Mode the messages are sent through the Connext Sequencer. In this mode the Connext sequencer or any permissioned actor periodically submits an aggregate root. This triggers a 120 blocks window where any watcher can turn the system back into Slow Mode thus invalidating the proposed root. Only the owner can set the system back into Optimistic Mode. In Slow Mode messages from various domains are aggregated into one message root and are periodically sent to Ethereum using native AMBs. Note that for Optimistic Rollups (Arbitrum, Optimism) the AMB is only used as a transport layer, but 7-day delay is being ignored. Upon being delivered to Ethereum these message roots are subsequently aggregated again into a root-of-root of messages before being delivered to their destination domains. Each message can be optimistically fast-forwarded by a network of Routers that will front liquidity (if the message is a token transfer) or post a bond (if the message is a xChain call). Upon receiving the message root via native AMBs Connext bridge will reconciles messages and return bond to the Routers. There is a configurable delay programmed into the RootManager contract and the SpokeConnectors receiving messages. During the delay period a whitelisted set of Watchers can pause the bridge if the fraudulent message passed via AMB is detected.
Validation via Native AMBs
Messages on the source chain are send perdiodically to the Ethereum chain via native AMB. Once they arrive on Etherum, they can be send from Ethereum, again via native AMB, to the destination chain. Token transfers can be fronted by Routers providing liquidity. Similarly arbitrary messages can be sped up. Watchers provide additional protection in case native AMB gets compromised and forges the message. For optimistic rollups (Optimism, Arbitrum) their native AMB is used but 7-day dispute window is ignored. For BSC (Binance Chain) MultiChain AMB is used.
Users can be censored if watchers disconnect certain connectors or pause the whole bridge for no reason.
Funds can be stolen if native AMBs that Connext uses allow for passing forged messages and this is not caught by Watchers.
Funds can be stolen if connectors to optimistic rollups (Optimism, Arbitrum) receive a fraudulent message within 7-day fraud-proof window (CRITICAL).
The system uses the following set of permissioned addresses:
Owner of the main Connext Bridge Diamond Proxy. Can upgrade the functionality of any system component with no delay. Maintains the list of Watchers. This is a Gnosis Safe with 8 / 12 threshold.
Those are the participants of the Connext Multisig.
Collects fees from the bridge. Can manage Routers through its RouterAdmin role. This is a Gnosis Safe with 1 / 5 threshold.
Those are the participants of the Connext Fee Multisig.
Permissioned set of actors who can pause certain bridge components. On Ethereum L1 Watchers can pause RootManager and MainnetSpokeConnector, i.e. modules receiving messages. They can also remove connector from the RootManager. List of watchers is maintained by the Connext MultiSig.
Permissioned set of actors that sequence routers request to forward liquidity.
Permissioned set of actors who can perform certain bridge operations.
Permissioned set of actors who can forward liquidity and speed-up message delivery.
The system consists of the following smart contracts:
The main Connext contract. Following Diamond design pattern, it contains multiple Facets that implement various parts of the bridge functionality. This contract stores the following tokens: USDC, WETH, USDT, DAI, Metis, alUSD.
Contract responsible for maintaining list of domains and building root-of-roots of messages. It keeps tracks of all hub connectors that connect to specific domain.
Contract maintaining a list of Watchers able to stop the bridge if fraud is detected.
Contract that receives messages from other Domains on Ethereum.
Contract for sending/receiving messages from mainnet to Polygon via Polygon FxChannel AMB.
Contract for sending/receiving messages from mainnet to PolygonZKEVM via PolygonZKEVM AMB.
Contract for sending/receiving messages from mainnet to Gnosis via Gnosis AMB.
Contract for sending/receiving messages from mainnet to Optimism via Optimism AMB transport layer. Note that it reads messages from Optimism as soon as Optimism state root is recorded on Ethereum w/out waiting for the 7-day fraud proof delay window.
Contract for sending/receiving messages from mainnet to Optimism, duplicate of OptimismHubConnector.
Contract for sending/receiving messages from mainnet to Mantle via Optimism AMB.
Contract for sending/receiving messages from mainnet to pre-bedrock Optimism based projects via Optimism AMB.
Contract for sending/receiving messages from mainnet to Optimism via Arbitrum AMB transport layer. Note that it reads messages from Arbitrum as soon as Arbitrum state root is recorded on Ethereum w/out waiting for the 7-day fraud proof delay window.
Contract for sending/receiving messages using Wormhole.
Contract for sending/receiving messages using Wormhole, duplicate of WormholeHubConnector.
Contract for sending/receiving messages from mainnet to Linea via Linea AMB.
Contract for sending/receiving messages from mainnet to Mode Network via Optimism AMB.
The current deployment carries some associated risks:
Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).
