Scaling
Bridges
SummaryValue LockedMilestonesDetailed descriptionRisk summaryTechnologyPermissionsSmart contracts

L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our discord to suggest improvements!

Orbit Bridge logoOrbit Bridge

Orbit Bridge is part of the Orbit Chain project. It is a cross-chain bridge that allows users to transfer tokens between supported blockchains.
Orbit Bridge has been hacked on 1 Jan 2024 and is potentially not safe to use.
  • Total value locked
    $12.91 M2.28%
  • Destination
    Various
  • Validated by
    Third Party
  • Type
    Token Bridge
    • Value Locked

    ...

    Milestones

    Orbit Bridge hacked for $81.5

    2024 Jan 1st

    Learn more
    Detailed description

    Orbit Bridge is part of the Orbit Chain project. It is a cross-chain bridge that allows users to transfer tokens between supported blockchains.

    Tokens are deposited on the source chain and “representation tokens” are minted on the destination chain. Deposited tokens are not precisely locked and can be used in DeFi protocols by Orbit Farm. Accrued interest is not passed directly to token depositors.

    Risk summary
    This project includes unverified contracts. (CRITICAL)
    Orbit Bridge has been hacked on 1 Jan 2024 and is potentially not safe to use.

    Funds can be stolen if

    1. validators relay a fake message to a destination chain to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL),
    2. validators relay a fake message to Ethereum chain allowing a user to withdraw tokens from Ethereum escrow when equivalent amount of tokens has not been deposited and burned on destination chain (CRITICAL),
    3. there's an exploit in contracts that invest user deposit (CRITICAL),
    4. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL),
    5. the source code of unverified contracts contains malicious code (CRITICAL).

    Funds can be frozen if

    1. validators don't relay messages between chains,
    2. there's insufficient liquidity of requested token in escrow.

    Users can be censored if

    1. validators decide to not pass selected messages between chains (CRITICAL).
    Note: This project's overview requires more research and might not present accurate information. If you want to contribute you can edit the information on Github. Alternatively you contact the project team on Twitter and encourage them to contribute a PR.
    Technology

    Principle of Operation

    Note: This section requires more research and might not present accurate information.

    Orbit Bridge is a cross-chain bridge that allows users to transfer tokens between different blockchains. Tokens are deposited on the source chain and “representation tokens” are minted on the destination chain. When a user deposits tokens to an escrow contract on Ethereum, a message is relayed to a group o validators via Orbit Hub contract on Orbit chain to a minter contract on a destination chain, where “representation tokens” are minted. Deposited tokens are not locked and can be used in DeFi by Orbit Farm. When a user deposits minted tokens on the destination chain, they are burned and a message is relayed to validators through Orbit Hub contract on Orbit chain to the ETH vault bridge contract, which releases the tokens if at least 6 / 10 validators have signed and liquidity is available. The source code of the farm contracts is not verified on Etherscan.

    1. Bridging transactions

    Validation

    Note: This section requires more research and might not present accurate information.

    Orbit Bridge actors include Operators and Validators. Operators relay data between Orbit Chain and supported chains, while Validators build multi-sig based consensus on validity of transactions.

    • Users can be censored if validators decide to not pass selected messages between chains (CRITICAL).

    • Funds can be stolen if validators relay a fake message to a destination chain to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL).

    • Funds can be stolen if validators relay a fake message to Ethereum chain allowing a user to withdraw tokens from Ethereum escrow when equivalent amount of tokens has not been deposited and burned on destination chain (CRITICAL).

    • Funds can be stolen if there's an exploit in contracts that invest user deposit (CRITICAL).

    • Funds can be frozen if validators don't relay messages between chains.

    • Funds can be frozen if there's insufficient liquidity of requested token in escrow.

    1. Orbit Bridge - How it works
    Permissions

    The system uses the following set of permissioned addresses:

    Bridge contract Governance 0x35f7…d5Ba0x98A8…66D00x34EB…5a8b0x3b65…54B00x3924…c6460x8c7a…32140x1c0C…543E0x6013…74370xa6dc…a3a10x86ce…61E2

    Participants of the Bridge Governance: 6 / 10 Orbit Multisig. They have admin access to the proxies’ functions and can upgrade the bridge implementation without delay.

    Policy Admin 0x09F3…eaD8

    Can set bridging fees, gas limits and can pause / unpause the bridge or censor individual withdrawals.

    Smart contracts

    The system consists of the following smart contracts:

    ETH Vault 0x1Bf6…489aImplementation (Upgradable)

    Bridge contract, Proxy, Escrow, Governance. This contract stores the following tokens: ETH, USDT, DAI, USDC, WBTC, MATIC.

    USDT Farm 0x378F…a4d9Implementation (Upgradable)Admin

    USDT Compound Farm. The source code of some implementations is not verified on Etherscan.

    DAI Farm 0xBe03…aCd0Implementation (Upgradable)Admin

    DAI Compound Farm. The source code of some implementations is not verified on Etherscan. This contract stores the following tokens: cDAI.

    USDC Farm 0x8304…2474Implementation (Upgradable)Admin

    USDC Compound Farm. The source code of some implementations is not verified on Etherscan. This contract stores the following tokens: cUSDC.

    WBTC Farm 0xd910…08DaImplementation (Upgradable)Admin

    WBTC Compound Farm. The source code of some implementations is not verified on Etherscan. This contract stores the following tokens: cWBTC.

    The current deployment carries some associated risks:

    • Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

    • Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).

    If you find something wrong on this page you can submit an issue or edit the information