# Securing Cross-chain Communication by Nithin Eappen | Devcon Bogotá

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-07
- Duration: 24:07
- Watch: https://streameth.org/watch/yt-sAVhW_xqrvY
- YouTube: https://www.youtube.com/watch?v=sAVhW_xqrvY

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/securing-cross-chain-communication/

The last year witnessed several cross-chain bridges being hacked and millions of dollars stolen by hackers. Despite the bridges having gone through several audits, we still see them getting exploited because hackers were able to get access to authorized private keys, signature replay attacks, etc. Let us see what a secure cross-chain bridge architecture should look like and what are the possible attack vectors and mitigation techniques.

Speaker(s): Nithin Eappen
Skill level: Intermediate
Track: Security
Keywords: cross-chain,bridge,security

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] I'll be speaking about securing cross-chain Communications you'll be stuck with me because due to Central actors Colombia did not give visa to the guy who was supposed to come and present this okay I can't even imagine why they would cancel the Visa imagine you know the business that was supposed to have been here right so I'm not a technical person I'm supposed to take a technical presentation so bear with me if I'm going wrong I'll try to keep it as clear as possible I'm on the phone with them if there are questions at the end that I don't know the answer I'll call them up uh those guys are very technical okay so basically uh even the last talk was about securing Bridges and stuff like that but let me try to make it why are we interested in bridges what is making it so attractive I think there are two things as devs you can see that layer 0 raising 135 million hash flow raising 25 million no about raising 22 million now from the hack side Ronin Bridge lost 600 million last year warm her or losing 325 and Harmony bridge is an example of losing 100 million right so this is why it gathers attention there's so much money involved so before I go um deep into the talk the idea is I'm going to explain just basic about the space about bridges cross chain why is it important some of the examples out there and then some of the hacks that happen and what caused those hacked okay that's the the general idea how the talk is going to go fundamentally what is a blockchain if there are people who know this is out here it's basically at Ledger and what does it store it stores data and transactions data and transactions as long as you can move them they have value and when they have value there's a price and there's an exchange and there's a market cap so numbers are a little off you're only at 950 billion today but let's assume the market cap is 400 and at 1 trillion we're at 450 billion in Bitcoin 200 billion in ether 50 billion binance and the rest of them make the market cap so basically there's value across different chains and it's fragmented that's why cross chain swaps are cross chain bridges are important they're just so basically blockchains are really desperate wall Garden Wall islands of value so you have two islands if you can't move the assets across these islands you can't move value across them imagine traveling from U.S to UK and you can't use your money over there kind of useless right there's a restaurant out there who's willing to take your money in but you you don't have pound with you you just have dollars so that's where you need something in between like an ATM machine Banks or credit card processing something like that to move these value from one Island to the other fundamentally that's what a cross Chain Bridge is you have some assets or valuable stuff on one blockchain you want to move it to another blockchain that's a bridge when you're doing a swap you take exchanging a token on one blockchain for a different token on another chain so fragmented users and value to move across chain without friction now think of it that you had to do this let's assume that you wanted to use a Solana you had Solana with you and you want to use ethereum and you had to go to coinbase to sell your Solana to USD and then buy ethereum and then bring it to your app imagine doing this when you're traveling imagine you're you've come to Bogota a lot of you come from other countries right imagine going to the bank changing money instead of just using your credit card somewhere you know at your hotel or at the restaurant the D Phi is going to be very big that's the Assumption let's assume that all of you are assuming that with me we are all going to replace trade fire the traditional Finance one day if that is the case this piece cross chain swaps Bridges or cross-chain communication is going to be a very critical infrastructure all right so fundamentally there are three there are three three things that are very important you're moving between proprietary blockchains taking an example is moving Solana from an SLP standard to a binance smart smart chain with a bep20 how about transferring assets between layer twos between arbitrum and optimism if you want to do that today imagine you have to take your arbitrum put it back to ethereum you have to wait seven days then you have to move it to optimism right that's what that is the friction that we want to reduce with cross chain swaps so generally there's an architecture for this you are you you're transferring information it could be asset it could be contract calls from one blockchain to the other so on one side you have a node that monitors the source gene or the original chain we call them the validator that transmits information from the sourcing to the destination chain in between there are checks and there are checks happening you know on requiring what is the consensus among the validators and there is a signature and eventually the validate on the destination chain verifies the signature and issues in IOU this is typically what that happens or the other way is you can send to a liquidity pool you can use amms and do this process so I'll now talk about the various types of bridges and the mechanisms out there one is the proof of authority Bridge a POA Bridge you have a small set of actors that are listening to events on the source chain they validate them and they relay this across to the destination chain incentivization slashing mechanisms ensure the Integrity of this thing so the pros are that there are few validators so it's very fast you can easily do it but the cons are now you've introduced Trust on these few validators there's a collision possibility something very similar is a POS Bridge or the proof of stake bridge now instead of one node you're giving it to the person who has more number of tokens or the token balance they do the verification and signature what are the cons the security depends on the price of these tokens the next is a light client Bridge example is a Rainbow Bridge so a smart contract with a ethereum like client functionality is deployed or near and a smart contract with near-line contract functionality is deployed on ethereum the verification is done by both chains calculating the Merkel routes and verifying at its headers there's no need of a validator besides the miner for both the chains it the cons are it requires a high it has a high implementation cost over there it requires smart contract development to hold both the like clients on both the blockchains so there's then there's an ultra light node with Oracle Bridge adapters it does not keep track of headers but it then it depends on oracles and relayers so then they can start colluding that's also possible the other option is we do chain Bridges you know the instead of validators you have a chain out there now that's an elegant solution when you take it that's truly decentralized there's a dedicated POS Hub then you can't do middleware logic over there so that's what people are trying to solve when it comes to chain Bridges side chains again you're connected to the main chain all those movements happen quick easy but then when you want to do between other blockchains it's not easy over there different kinds of bridges there's one as a custodial bridge wbtc wbtc is uh bitco holds the custody of wbtc the when you send BTC to get wbtc bitgo is the custodian a decentralized bridge or something like a wormhole unir directional bridge when you're doing wbtc you can only send from Bitcoin to ethereum you can't send back on the same Bridge Wormhole or multi-chain any swap those were the multi-directional bridges so fundamentally the idea is uh when you're moving across These Chains there's a lock mint and burn mechanism on how you move assets across chains so let's assume you have to move n tokens uh token Z from blockchain A to blockchain B so what's happening is these validators they are locking it on there on the source chain on the contract on a and they're minting a wrapped version of that on on B So eventually when it's replaced it gets burned and it is released the original tokens are released the problems over here there are problems also it's it's not like it's so easy as it sounds okay and the problems are as vitalik said now you're dependent in on the fact that nobody can change the chain on a so even the previous speaker she had a better graph for this how what you put over there vanish but the other side you got it when you come back your original stuff is not there all right so when you burn and come back your original should be there to get any benefit out of these we'll talk about some of the hacks that happened all right so the barley hack was 2021 it was a 600 million dollar hack so what happened over there uh the polyhack uh or Paulie there was a master you know you need a huge liquidity to do these things right that's what Paulie had a large there's a large TBL and there was a master wallet that contained these uh what do you call the assets um and it was based on Smart contracts large amounts for the large liquidity the hack was possible because of the access rights through these uh eth cross chain manager and heat cross chain data they got access because of the you know the bug over there they got access somebody outside made their address as the owner and they just drained the funds Wormhole hack here it was a little different what happened um again this was this year 325 million dollar hack a deprecated function uh was there they updated the GitHub but didn't go into production by that time the hacker knew that when they made that update this is where the problem is and there you go just use that drained it out um it's basically it's like you had at that point in the Wormhole case you had issued think of it gold certificates you're issuing gold certificates hoping that there's gold under the Vault what if there's no more gold under the world and people are coming back with those certificates in the Wormhole case you know obviously that was compensated by jump crypto and this is just showing what really happened over there the root cause was the signature was not set okay another example is the Ronin hack again 2022 600 million dollar hack it's more realistically here it was a web 2 issue so there are two kinds of security issues we can talk about there's a web 2 issue and there's a web 3 issue smart contract hacks that's a web 3 issue now here what happened was they had kind of nine validators and four of them was with Sky Mavis the guys who developed the game what happened they had given the signature uh to the sky Mavis team a year ago forgot to take that out uh this is how at least I read about the problem was somebody working over there they were given a job offer I was very excited I think they gave him three times what he was getting paid they sent him a PDF to sign you know he clicked through the PDFs and the keys were gone now they have control of four of the nine validators and the Dao and boom 600 million dollars mostly in ether was gone so the funny thing here was for close to a week they did not even know that this was happening at least most of the other ones there was somebody trying to find it or knew about it and here the hackers the funny thing was they even shorted axi and the wrong tokens they got liquidated because it didn't go down so you know but still money is gone Nomad hack was something like a decision that they made they gave up security for Simplicity basically the like clients they decided not to do that when the update was done a new update was done they could spoof transactions or fake them withdrawing funds which are not theirs and The Nomad attack was the funny thing was after some time anybody could hack them you could do it yourself and they were the white hackers who helped to take around 36 million was got they proceed back total I think eventually the loss was 150 million initially it was 190 I think 36 came back here you go the Fey hack 80 million dollar hack that was a re-entrancy bug now these are all very now nowadays three entrancy like it's like four years ago you didn't know about the re-entrants or most people didn't know but nowadays you have to know what were the previous hacks so knowing about these things helped the Beanstalk hack again here it was Flash loans were used to accumulate the governance protocol and then the once he got enough tokens he just put a proposal saying that donating funds to the Ukraine you know war and took off with all the collateral so I'm just explaining the different kinds of hacks here so I don't know who who put the statement out there so if you're trying to create a bridge between n different cryptocurrencies there's a goo guy I think the complexity of that is N squared so which means that there are N More chances so there are way more bugs that can happen over here than where you started so some of the things that we can look over here are coding practices right first thing obviously you should know the web 2 security stuff like social engineering phishing running a malware spyware protecting your keys fundamental things you can't assume that you're in web 3 you're forgetting all the web 2 stuff definitely have to do that then don't let a regular developer go and code a D5 you know blockchain smart contract where you're hoping to get billions of you know dollars into that contract because that's that's really like I put the exam it's like asking your house contractor go the bank is asking them to go build your world over there right you need somebody specialized so first you get somebody who's good at coding blockchain smart contracts and then you bring the security auditor so there's a paradigm shift that's happening earlier we just had one code it was on on your server now this is distributed it's going around everywhere it's it's a total paradigm shift so common set of problems you should know as a developer you should know the common set of problems like re-entrancy integer overflow and again when you're trying to do an update you know that there's a problem and you're going to do an update on a GitHub before it goes into production there's a small window you should know that the hackers out there are also waiting to Tamper on that and some of the other things you know typos you know uninitialized implementation contracts like proxies people have forgotten to do to do that and then attacker has come and taken that rounding errors unsafe casting then there are smart smart wallet attacks there's Merkel proof mishandling all these things could be prevented like if you're doing enough number of tests whether it's unit functional then formal verification fuzzing plenty of documentation and then on top of that you give it for audit those of you who are in the development space out here I would seriously say consider uh an auditor job because most of the guys the bridges I know they are paying a ton of money to Auditors despite having audit people on their team they're running these contracts through multiple Auditors I hear right now it's twenty thousand dollars to eighty thousand dollars per week for a security audit engineer per week so imagine there's a bridge out there or D5 projects out there they will need at least two months work from at least two Engineers very lucrative career man so think about it all right can we stop hacks it's like saying Can Microsoft can with all their money can it stop going down no it's a hard task there's going to be hacks it's just it's going to happen because projects are trying to scale speed they're using speed to try to get users as quick as possible so they're making decisions sometimes that this it should have taken much longer so now but there's one thing though the hacking of large amounts is easy maybe but taking it out is not that easy because now you have chain analysis elliptic and all those guys they're tracking it exchanges are you know Banning them tornado cash is being bad so there are a lot of things that help you but that doesn't mean that you should not take care of your code okay so keep in mind in 2013 the exchanges were being hacked it's just that right now it's the bridges because the surface area for them to attack is very very large that's the main thing main thing is how do you mitigate these things and what is your response once this happens obviously as mitigation part you know do your code well then you do audits front bug bounties but always remember if you lose money on your wallet or your smart contract the auditor is going to lose nothing he's just going to lose his reputation end of the it is your project the project is not the Auditors so you can come try to compartmentalize you can prevent contamination what if it happens how do you respond quick enough there are multiple times where these white hackers have contacted the teams out there saying that something is happening to your contract and the support staff said oh nothing we're fine and all their money was gone um I I don't have those tweets with me but you can check that out and your monitoring systems should be quick and you should have some kind of reporting guidelines once this happened what are you going to do as a team how are you going to protect yourself how are you going to bring your chain down if you can is there some kind of kill switch because a lot of these things are centralized so basically Bridges have Pros you're bringing collateral cross chain you're getting scalability you're bringing efficiency the cons are you are introducing some form of trust the trustless part is going away so this space is going to grow mainly because of these things so much money money has to move and a lot of ways to attack these contracts so both sides developers uh hackers and PCs are going to invest in the space because just like think of it in the real world just like you have ATMs banks credit card processing machines bridges are are a very big thing I think that's it from my side questions I guess everybody's being nice to me think they think that you know if the guy doesn't know anything so let's not complicate it all right there's somebody is out there uh a mic over there please I can I can try to answer some of the things but if I can't I'll tell you guys I'll take your name I'll contact the guys who made the protocol and get back to you for sure um I was wondering if you have any recommended training resources for developers specifically focused on security right how do you take developers don't know security and be confident that they do at the other end got it I think the best is uh first learn uh smart contract or solidity from let's say uh Patrick Collins is a YouTube video dap University is out there and then securium is a good place they have a boot camp and they have a lot of uh tests quizzes and stuff which they go through all the possible problems that you can face and there are multiple challenges out there either not challenge there's ethernet they're plenty like that I forgot each of the names where I can get get it out for you okay that's a start learn solidity next thing is go to securium and find out how they do and that's as I said there are at least 10 jobs for every one security guy out there especially in the web 3 space and it's remote you can stay at your home you can be on the beach you can do it too the perspective was pretty bleak when you talked about like end to end like the Android complexity of like uh bridging all kinds of bridges but then we here at the ethereum Devcon and we know like the Roll-Ups are the way to scale so we want to have actually a thousand yeah of these l2s right so what is your perspective on that how are we going to solve this issue so initially for any technology so how many exchanges are being hacked today they're not you know you don't say coinbase or binance being hacked on a daily basis right but if it was 2013 literally every exchange was being hacked right everybody so same thing with defy or Bridges it's new when when did bridges come into being it's pretty much only two years or one year and everybody and you have multiple layer one blockchains out there and you're trying to connect to these things what what are the number of years of experience to somebody who's coding this right majority of it is one to two years you don't have four years six year people who like when you when you're building your NASA uh you know space shuttle or you're doing some C sharp or C plus plus code Java code there are guys who have been doing it for 20 years who know the formal methods and stuff like that so those problems will be solved it's like the buggy and the car okay the car was initially was a bad technology it was slower than the horse technology improves they fix those kings the wheels were flying off you flattened the roads you make better Wheels you make better shafts all those will be fixed so the future is not Bleak the future is really good more money will come in as devs there's there's going to be plenty of opportunity now as the project owner who's doing one of these it's it's really dicey right now because you don't want to get hacked I I know the router protocol guys they're everyday scared they keep their TBR low because once the tvl becomes high you're a Honeypot like everybody wants to attack you if your tvl is low you know that this all the great hackers are not so interested in your tvl which is low they're thinking of high Capital efficiency by keeping the TV alone that's how they are trying to do it hi yeah can you hear me yeah yep I can okay great um so I was wondering on that scenario that you described that the developer he got a contract like a PDF contract with a virus um and took over his nine keys and therefore the bridge Jesus Christ that that just made my palm sweat I just spoke about that um so it I would like to understand a bit more about that case like he had the keys in his computer just lying around there how how did the hacker extract that instead of the computer it's not like he had it in a sand it's in the computer that you're giving access literally so imagine you get these PDFs nowadays you can sign your PDF it was a job offer right so somehow they knew that this was the guy so they could get into the system they just have to get into the system because it's connected right a job offer came well you know they did interviews they were formal interviews done all those it looked very legit and then you get a PDF saying and you got the call saying hey I'm sending you the job offer you just click on it click the signs you're not expecting it right so there it's not really your web 2 the web 3 that's a problem it's a web 2 that has failed so both have to be considered today but do you feel like there's something he could have done to protect those keys better so like not keeping them on the computer for exactly definitely they should they shouldn't I'll give it to a guy who uh who had four validators with them guys thank you so much time is up so I'm getting down [Music]