Thread by @bkiepuszewski

A long thread about Optimistic Bridges and why we think @HopProtocol falls into this category (@l2beat will change the classification). Optimistic bridges are an exciting new class of bridges with @nomadxyz_ / #Optics and @AcrossProtocol falling into this category as well 👇🧵

All these constructions are different but they have one thing in common - when message is passed from source to destination chain, it is assumed to be genuine/valid unless proven otherwise by some independent Watchers /2

The main question then is - are these Watchers actually watching the bridge and how long is a “fraud-proof window” during which the validity of message can be challenged /3

The ultimate security of optimistic bridge relies on the fact that there will be at least one honest Watcher and fraud proof window is long enough to enable this Watcher to raise an alarm in the most adversarial network conditions /4

Optimistic Bridges - if implemented correctly - are exciting because this is quite weak security assumption. You never know if the Watcher is watching. Typical downside is finality - users might need to wait for the end of the fraud proof window to consider the message valid /5

We have already seen few unsuccessful theft attempts from RainbowBridge (it has an optimistic component) and one failed whitehack attempt from Fuel 1.0 (

https://twitter.com/krzKaczor/status/1524753284434587649?s=20&t=MjK_HyjQTj_B82n4ssSjqg

) to prove the point that Optimistic constructions are far more secure than most people think /6

Let’s look at the details of @HopProtocol and its optimistic settlement process. Hop uses L1 Ethereum as a settlement layer. L2->L1 message bundle will travel via a regular, “slow", 7-day long path using the canonical bridge of a given L2 (say @optimismFND , @arbitrum, etc…) /7

To facilitate faster withdrawals an entity called Bonder can “pre-announce” the message bundle via bondTransferRoot() Bridge method. If it does that, it has to “overcollateralise” the bundle by providing extra liquidity to the Bridge and withdrawals can start immediately /8

As an example, for a bundle containing withdrawals of total amount of 92,448 DAI the collateral put by the Bonder needs to equal 101,692 DAI (110%)
ethtx.info/0xeb83e1e46920… /9

This collateral is taken off the overall stake put earlier into the bridge - you can see 1,500,000 DAI staked by this Bonder e.g. in this transaction:
ethtx.info/0xd91c48d7947c… /10

After 24hours, if nobody challenges the validity of the Bonder’s message, Bonder can withdraw all collateral. However any other Bonder can challenge the validity of Bonder’s message bundle by putting a bounty of 10% of the challenged amount themselves. /11

If challenge is placed, Bonder’s collateral will be locked for the full 7 days until the “correct” message bundle finally settles on Ethereum and we will know for sure who was right - Bonder or Challenger /12

If challenge is successful, all potential withdrawals that happened in the meantime will be settled with Bonder’s collateral (as opposed to funds locked in a Bridge). Successful Challenger will get 3/4 of Bonder’s extra 10% while 1/4 will be burned /13

If challenge is unsuccessful, Bonder will suffer from a week-long lock of collateral but will get a full Challenger’s bounty as a compensation and withdrawals will be settled with funds locked in a Bridge /14

The setup - in theory - is completely trustless, albeit it does require some upfront capital from Bonders that can be problematic for big withdrawals /15

Interestingly, because Hop requires message bundles to be collateralised, withdrawals can start immediately and users don’t have to wait till the end of the challenge window (currently set to be 1 day) /16

Also note that at the moment both Challengers and Bonders have to be whitelisted. Having said that the next version promises to have fully permissionless setup so that any one can be a Bonder and Challenger /17

The current length of fraud proof window in Hop is 1 day. Compare it to Nomad (30 min), Across (2 hours) and typical Optimistic Rollup (7 days). Fraud proof length is important - if malicious Bonder is not challenged within 1 day in @HopProtocol it can drain the Bridge /18

To reiterate - suppose I am malicious Bonder and I want to steal 1,000,000$. I have to put 1,000,000$ of my own capital upfront first + 100,000$ extra bond. If I am successfully challenged within 24h, I will loose that 100,000$ /19

For the thief, hoping that there will be not a single one honest Watcher that might want to grab that 100,000$ for free is like hoping that there are no MEV bots in a dark forest. Small chance these days on Ethereum. End /20