[trustless://eil] Bartek Kiepuszewski - Interop Risk Framework by L2BEAT

Transcript

All right. Uh, we are about to have Bartik up on stage, the founder of L2B to talk about risk. Big round of applause. Come on, guys. There we go. So, uh, good afternoon everybody. Or should I say Argentina? No. us don't understand. No worry. Um so it seems like my fate um is to come to South America and announce a risk framework for bridges. Uh I've done that uh three years ago. Um when I

was in Bogotaa three years ago, uh we announced L2B for bridges which was our attempt to police uh interoperability solutions at the time. And while I kind of consider L2B to be highly successful organization, we keep uh all the L2s at check. So whenever you hear that this L2 or that L2 is stage one, stage two, uh we set these standards and we do uh all the hard work uh to check that they are not lying to you uh that they are true uh to what they say. And believe me, this is a lot of work. So we kind of thought that you know this is needed as well for the interrop and um like I say um while I think that we are doing an

amazing job for uh for L2s uh we kind of like failed uh to actually do it for bridges. Um so it was kind of a a simple framework. Uh we divided bridges into two main categories. first like a token bridges uh those that uh can mint tokens and uh the bridges uh that we call liquidity networks uh those that don't mint the tokens that they just like send you tokens on the destination and uh I thought at the time that the most important uh uh consideration was the validation mechanism. Uh we could like look at the bridges from the point of view how trustless they are. Um and uh we wanted all the bridges to go from

from like the bottom where you have to trust the third party you have to trust some operator uh all the way to to the top. Uh the the trustless version uh the best version is like a rollup bridge stage to rollup bridge and we kind of thought that you know three years ago most of the bridges were third party and they would all go up as long as we pushed them to do that. Um unfortunately you know the space has moved in the direction that we did not see and this is probably uh one of the reasons why we kind of failed with this effort. Uh today it seems like every single bridge that you'll see is kind of the same.

It's super complicated. It's both token bridge and liquid network and in network in one. Uh it acts as a bridge aggregator. It chooses the the cheapest route for you. It's got a very complicated routing logic. uh it actually allows you to do the same chain swaps the different chain swaps. Um in short it's super uh complicated and UI abstracts uh this complexity. So you cannot like do this simple classification of these bridges. Uh but also it's even worse because it's not like every bridge is complicated. Now uh most tokens are omni chain tokens uh so that they can actually move these tokens around between different chains and

every single little token is actually a little tiny bridge with all this underlying complexity below. So we have layer zero fds hyperl tokens ID chain link wormhole circle cttp and even like a wrapper on top of all of them. So uh it just became way too complex and I think we focused on the wrong thing. So uh I'm basically happy to announce here that uh we're going to do a second uh attempt at policing interrupt. Uh we but this time we're going to do it uh in a slightly different way. Uh going back to the basics, uh we kind of thought that uh most users should care about safety

and livveness of bridges, right? you should like hope that the bridge is not going to lie to you. Uh if you bridge 100, you know, 100 will be actually minted on the other side and they won't like mint for themselves uh money that they don't belong to them in a way. And the bridge should be live, right? Uh meaning that if you send some money through whatever interop uh facility uh you might use, eventually uh it will reach the destination, right? So you don't have to wait for a couple of hours. Uh that's what we thought that you know is like the most important. Uh however I think for that for the end users actually these things matter more.

Uh they mostly are worried about the price. They just want to get as cheap solution as they want. Uh they uh want to get money as fast as possible. And the safety is kind of like a second thought, right? Like most users actually think that once they bridge once they are on the other side of the bridge they safe. So they might be in danger for some time you know they might actually feel this dread of bridging but once on the other side you know they are probably right uh safe and and the risk is gone. Uh this is not true by the way for a lot of constructions. However that's how most uh users actually think about these constructions.

So um if you go to uh to a center of Buenosiris uh you might actually meet these people you know they like stand in the middle of a street even now even though that the times uh changed in Argentina and they like keep shouting cambio right uh they call they call them agalitos uh here and they simply you know uh allow you to to to swap your US dollars for the Argentina pesos. Um so um any of you have uh actually uh used such service? Few. Uh would you give $100 to that guy and allow that guy to to walk into the dark alley uh with the promise to come back one minute later with Argentinian pesos? Who would do that? No one. How

strange because this is like literally what you do every single day on blockchain. That's what you do. And not with just $100, right? like you do it with often much more money. I mean like for me uh frankly it is like super hard to process uh why this is actually the case like why normally in real life you know our instincts would go no no I don't trust this guy right I don't know him whereas on blockchain it's all fine you do it every single day I can assure you um take an example you know uh this is a bridge this is an official bridge from the top rollup the rollup that put millions into the security that secures

trillions of dollars, billions of dollars. Uh that is a stage to roll up and that uh I'm sure cares a lot about being trustless. Uh they like heading up the space and that bridge when you want to move uh some Eve in this case is like you know $3 whatever it actually suggests you three different routes that you can take. You can take uh what they call the best deal route. Uh you can take what they call the fastest route and the route called secured by arbitum.

Right. So which one would you choose? Who would choose the bottom one? Okay. Couple of people. I'm assuming that the rest would choose the top ones or they too shy to actually say. that let's assume that whoever is going to choose the bottom one is definitely the minority. Uh but maybe maybe we're wrong. Maybe our instincts are wrong. So we actually spent couple of months observing the chain for the real interrupt transactions. And by the way, this is not easy uh tasks. I mean if you try to do that, you know, it takes actually some time to analyze all these protocols. And uh before I show you the result, I was actually wondering like maybe there's some extra explanation

like what is where is it to be secure by arbitrum but but no nothing happens when you hover on these buttons right if I were to design this UI I would kind of put something like this. Uh the bottom one would say regardless of the quantity your transfer will succeed eventually. The top one, the success of your transfer depends entirely on the goodwill of the trusted operator. The transfer may fail. Your funds could become stuck. Be careful, especially when transferring significant amounts. And I wonder how many users would actually change uh you know the choice. How many users would go for the bottom one if they knew? It's just that they don't tell you for some reason. Uh so what do users choose? Maybe they know better. Uh let's have a look. Well,

turns out that uh the vast majority of users are actually choosing a protocol called relay, which if you didn't know is like by far the most used right now, interop protocol. Um and um then we have Gsip uh which is like literally the same. You have to trust the centralized operator uh across uh that uh is uh arguably better. And then you have got CCTP layer zero Stargate uh and other protocols. And this is like the breakdown of the messages the interrupt messages uh between Ethereum arbitum optimisment base. So granted you know I mean these are not all the chains right but you know we're talking about the

main chains and Ethereum and the messages between these chains. So uh so the relay is by far uh the the most used protocol. So what is relay? So I'm going to show you how relay works slightly simplifying because you know there are like various variants if you like but I'm going to show you uh probably one of the most popular variant because it's the cheapest. So uh this is what happens on the source chain. You're literally sending your uh ERC20 token to to an EOA. That's what you do. And when you say uh when you transfer this your way uh you append in the call data at the bottom you can see in the transfer

function this this long hash uh this is additional ID that you append and that's it. There's no event uh other than sending ERC20 token. So if you're sending if there's like literally no event whatsoever because when you like do the if transfer no events uh and you're sending into the solver to the EOA account there's nothing cheaper that that right you cannot do any interrupt cheaper than that. So what happens on the destination? Um this is essentially the same. You get uh hopefully you get your funds on the destination chain just being sent from your way. That's it, right? And and you look at your transfer

and you will see the same hash. So you can actually identify on chain like you can match the source and the destination from this hash. And by the way, this is kind of curious because normally transfer only gets recipient and amount right in the cold data. So if you didn't know, it is actually possible to attach some extra cold data which goes beyond the API. Um that's kind of cool. Uh it's just that the ether scan doesn't know about it because it knows AI that says transfer address and amount. You have address here right in the stop line. You have amount the middle line, but the third line is like no one knows about it, right? This is like this extra call data and that's it. Two transfers, right? So, so where do you get this ID

from? U this is how it works. Before you do your transfer, you actually ask the offchain API, right? You ask the uh the guy uh through the offchain API, hey I want to do something uh and the this guy says cool send some funds to this EOA address and this is the ID and I will do that something and that something can be frankly anything right? Uh it can be like send me some funds on the destination chain. It can be buy me an NFT on OpenC. Maybe it could be even like buy me an Amazon book or something, right? It doesn't matter what it is.

Essentially, you're trusting this guy who wants you to send funds to your way that this guy will actually do what they promised. That's how it works. It's super easy, right? So, I mean, for me really, I mean, this is the arolito situation, right? Uh, and we all do that onchain. So, so I don't know. I mean, the relay protocol, they keep saying that, you know, uh, relay is revolutionary, but, uh, I guess I'm too dumb to understand that. So, maybe, uh, maybe we're going to find out how revolutionary it is. But for me, what is really re revolutionary about this space is actually the ability to build trustless protocols. And trustless protocols are obviously harder, right?

They're harder to build. They are more complicated and and and you need more effort. Uh, as simple as that. So, so maybe you haven't heard about relay. Uh, this is actually kind of funny because like I say, I mean this is by far the most used protocol in the space. Most people have heard about the cross. Uh, because it's been longer, much longer. Relay is a relatively new protocol. Uh, it's been launched last year. Um and if you compare across to relay uh you'll see that uh the settlement protocol in across is actually quite complicated. It evolved over the years. You know they've been uh they put a lot of work and

effort into that. Um it includes permission permissionless relaying after uh some exclusive timeline. It includes refunds and dispute via optimistic oracle called UMA. They actually in the latest version also worked with succinct to introduce ZK proofs. Uh so cost and transfer speed for users is like very low but it's not super low like with relay is very low and it's very cheap and if your UI will choose the cheapest route for you they will choose relay obviously they will choose protocol which is like super simple and 100% trusted over the protocol that puts years of effort into making it uh trustless right so if we were to design

the trust metric around these protocols. Uh we would probably say that relay is like super low and across is like relatively high. Maybe it can be better. Uh but our goal I think as a community if we trust if we can of sign this trustless manifesto is to try to push relay towards a cross and at the same time try to push a cross towards uh what we would describe as an equivalent of a stage two rollup, right? uh something that's truly trustless because there are trusted components in the cross. So let's have a look at another protocol which is highly successful. Uh you might have heard about lay zero uh this is interoperability protocol that uh is

powering um omni chain tokens um and again if you compare omni chain token protocols uh layer zero has a very significant lead uh and market share. So if let's say you're working on RWA uh it is extremely likely that they will try to convince you that you should design your RWA as a nomin token with layer zero. So how lay zero works uh essentially uh what happens when you design your token uh this is the USDT zero token that you see on the left you will have to like define uh your validation uh logic if you like which in uh almost all cases comes down to using

one of what they call DVNs uh and you may have one DVN uh attesting a message you may have more than one DVN in which case it becomes kind of a multisc out of two multisc. So uh so this is you define that as your application as your token. The problem is that you actually uh define it for every single route individually. Right? So if you want to be on let's say 50 chains suddenly you have to 50 square routes to define. Suddenly you have to do this definition everywhere.

And the more chains you will support the more fragile you will become uh because it's like literally impossible you know to maintain uh this configuration. Uh and because of that the vast majority of tokens simply uh um use the default uh configuration. They just don't want to configure their own security. Uh they just uh fall back to the default security. And we did a little analysis uh what it means in practice. It means that for 13% of tokens and incoming packets, there's only one DVN testing.

So it's like a EOA. It's just one EOA testing. For 83% is two EOA testing. So it's like a two out of two multisig. And then you've got three, four, right? But the vast majority is like two or just one. And who is it testing? Um, oddly enough, Nethermind is one of the main attesters. So you can see 60% of packets are tested by two out of two multisc which is uh comprised uh from nevermind and stargate and again that's kind of to me interesting to know that nevermind you know uh one of the main contributors to trustless ethereum developers of one of the nodes and obviously you know like

very beloved uh community and yet somehow suddenly look under the hood and then turns out that this arbolito is never All right. Uh so uh that's what we are. So let's have a look at some more data. Um base optimism, arbitrum and ethereum. Like I said uh the green lines are canonical bridges and the red lines are all the other protocols. Right? So we look at all the data. We look at all the protocols and uh uh this is what we got. Like I said before Moses relay uh then we have circle CTP hyperlane across gaszip.

That little square here is canonical the the pinkish one, right? That's what we want. Instead, what we have is all the all the rest. So, uh if you look at the same token transfers like you transfer if uh across or transmdc again by the number of transfers it's mostly relay across uh however by the volume suddenly CTP turns out to be uh the the the biggest uh the most used bridge which is kind of interesting. Um and and maybe this is a little bit comforting that if the transfers are over 100K then then people indeed turn to move a little bit higher up the

security stack right so for the biggest transfers versus or stack and optack I mean these are like the canonical bridges um however relay is not at the bottom right and and you can see that actually uh this is 24hour by the way right so at one day like maybe two days ago this is very fresh data uh that we saw 725 transfers of a relay that were above 10k okay so we're giving to our bolito like maybe 20k or 50k so that's that's how we work today and we think at l2 beat that uh I guess we need to change that uh so that pretty much like paints the same

picture It doesn't matter whether we talk about Ethereum or arbitrum or base you know the the um I guess the space looks more or less the same right um so to sum up this uh before I kind of like show you what we plan to do uh I think at the moment I would probably see the state of the interrupt as something like this um either you either use omnitrain tokens in which case is like a hot potato uh because they carry on the risks with them. So if you receive this omni chain token uh you have to know that you trust you know these DVNs often the single one like never mind uh or you use something like

relay or other intent networks in which case you kind of hope for the best and once you get to the other side of the bridge you're probably fine because they don't mint tokens right so uh but they all trust it and I guess uh our work is to try to come up with a solution to to actually build this trustless uh world that we all kind of set to build. Um I kind of imagine that this is like literally the reason why we're in this space, right? Because we like to have trustless solutions. So uh without further ado, um I'm happy to announce that you know we're going to do the second attempt and see if this one this time uh it will be uh more successful. uh but with this second

attempt we actually take all the lessons from the uh framework that we've built for L2S and what are these lessons you know and I I I want you to reflect on these because uh literally all of them were unexpected to me when we started this work like five years ago so now I think that we know what is the secret sauce to actually make it succeed so first of all we think that the risk framework should have the right level of abstraction and what it means is that you know if you build a scoring system and you say that hey this bridge is 62 and that bridge is 55 that means nothing to users like literally nothing right scoring is in my opinion useless because it sort of like merges you know too many risks into one

little number and at the end of the day you know these numbers are not comparable. On the other hand, if you move to to an opposite direction and you design your risk framework with this huge table of hundreds of different, you know, criterias and you evaluate every single criteria individually, you'll end up with this long list of of green and and red and yellow and and users will be confused, right? And uh they'll and again, you know, they won't know what to choose. So, I think that the right level of abstraction is key. And this is what we learned for L2s. And for L2s we use uh on the one hand this this pizza which is like this five dimension kind of model uh where at the end of the day you

want to be green all over the place. On the other hand we have this stages rating classification. Right? So we want to actually have something very simple but tangible. Uh and if someone is at stage zero then we may want to push them towards stage one. And at one stage, you know, we may refuse to use stage zero systems. Um, so that is super important. Uh, we need some type of community pressure. We need the community pressure both from the top of the echelon if you like. Uh, and this is just an example like Vitalik says, uh, I take this seriously. Starting next year, I plan to only public publicly mention L2Z stage

one. So maybe maybe We should have something similar for interrupt, right? Maybe we should like promote uh good interrupt solutions and like like be silent about all the others. Maybe I don't know. Uh we're going to have a panel tomorrow. We will be discussing this, you know, with uh different uh founders of the different interrupt protocols. Please come by and let's see uh what they have to say. But also uh we need the community. We need like all the L2s to kind of like buy into this network, right? This is a random I I I admit I've chosen random. Uh the guy from Chroma, all I want for my L2 is green pizza. So all L2s have actually signed to that. Like they signed, you know, people signed this uh trustless

manifesto. All L2s have said that, you know, we want green pizza. Uh which is great, which is at least, you know, that's what they said publicly, right? And now we can like push them uh to actually deliver that even though it's hard and uh it's not uh it's it just costs more money. We need to have a clear northstar. That's very important. Uh and uh this is coincidence that you know a week ago the trustless manifesto was published. I'm I'm like super happy because we don't need to define the north ourselves. Now we can say well you can only be green if you like adhere to these rules right if I need to trust arbolito uh which is

hidden behind your EOA then then you're obviously red like like you know I'm trusting a stranger I don't know right I can't sue you if you screw it uh I don't know who you are uh I mean go to relay page and try to find you know where to go if your transaction fails like I would feel safer if there was like terms and conditions and like like even if it was sashelli or something I would still feel safer but there's nothing zero so it's our unknown maybe yellow will be something in between right but you know but but there should be some some kind of a northstar I'm not trusting anyone here I'm trusting EOA unknown over there you know I may be somewhere in the

middle uh but you'll never be in the middle if I need to trust uh unknown EOA right and the green uh I don't trust anyone. Um, it should be hard to game uh the framework uh but fair at the same time. This is probably the hardest uh thing to do. For example, uh there's a a rollup called Facet uh which is arguably stage two. Uh we spent weeks uh discussing with them. the stage designation and a lot a lot of community uh disagreed you know they were kind of angry at L2B

there how can facet be stage two if there's only $170 canonically bridged everybody else is using uh a bridge which is secured by your way so essentially it's it's completely trusted uh all that money that you put in facet is completely trusted however you can use this canonical bridge So uh there's one brave person that actually used the canonical bridge to facet. Uh they moved uh $170 and you may be surprised or not at this stage but that person uh is actually from L2B. Um uh but we kind of proved that it works and we saw no reason not to give it the stage two because you

can. It's just that no one cares, right? So now we'll be actually changing uh the the L2 framework and we will actually say that yes facet is stage two as an infrastructure. However the escrow is right and don't use it if you care about trustlessness. Uh but there's another one. So we will be uh kind of evaluating escros individually. So there will be a big change uh to to our main website. Uh again, you know, much more work for us because uh we monitor hundreds of these L2s and each one of them may have dozens of this ex escros. So suddenly we're

talking about thousands of contracts to monitor daily. Um and finally, we need to work closely with the community. We need to make sure that we are able to adapt uh and we are like you know we need to have community engaged uh into the whole process right uh so what's next uh we'll be launching very soon the first version of a dashboard on this dashboard we will like mostly show you the data uh and we will expose some risk and we'll be adding more and more risks here right so we will cover all the inter protocols that are out there similarly to what we do to rollups. So it's not going to be like you know someone will have to come to us

right to get listed. No, if you build interup protocol we will list you and we will tell the whole world that you're are bolito that's what we will do. Uh sorry for that but you know but uh this is how it works right you know this space is just is what it is. So we will list all of them and we will list all that data. Uh so that's our pledge. uh we will show uh and disclose basic risks and eventually uh once we kind of discuss this with the community once the community learns what is the true state of interoperability uh then we'll move from just showing the state of ecosystem and disclose risks uh we will move finally to to actually have

the framework right uh so that we can actually define these stages if you like as long as we agree agree and we will try to to push all these projects to kind of sign the pledge uh similar to the trustless manifesto. The pledge essentially will say yes I agree that this is where I want to be in the future. We want to create more or less the similar kind of playing ground like we did for roll-ups uh where we uh acknowledged that most of the roll-ups were multisigs. However, they all pledged that you know like they are working on the proof systems. They want to move from a simple multisc to a security council. Eventually they want to get rid of the uh security council.

We want interrupt uh providers to to basically do the same. And hopefully this time uh we will succeed. Uh thank you.