Count of Monte Crypto: Accounting-based Defenses for Cross-Chain Bridges
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866915943821606912 |
|---|---|
| author | Liu, Enze Luo, Elisa Yan, Jian Chen Izhikevich, Katherine Grant, Stewart Stefan, Deian Voelker, Geoffrey M Savage, Stefan |
| author_facet | Liu, Enze Luo, Elisa Yan, Jian Chen Izhikevich, Katherine Grant, Stewart Stefan, Deian Voelker, Geoffrey M Savage, Stefan |
| contents | Between 2021 and 2023, crypto assets valued at over \$US2.6 billion were stolen via attacks on "bridges" -- decentralized services designed to allow inter-blockchain exchange. While the individual exploits in each attack vary, a single design flaw underlies them all: the lack of end-to-end value accounting in cross-chain transactions. In this paper, we empirically analyze 10 million transactions used by key bridges during this period. We show that a simple invariant that balances cross-chain inflows and outflows is compatible with legitimate use, yet precisely identifies every known attack (and several likely attacks) in this data. Further, we show that this approach is not only sufficient for post-hoc audits, but can be implemented in-line in existing bridge designs to provide generic protection against a broad array of bridge vulnerabilities. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2410_01107 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Count of Monte Crypto: Accounting-based Defenses for Cross-Chain Bridges Liu, Enze Luo, Elisa Yan, Jian Chen Izhikevich, Katherine Grant, Stewart Stefan, Deian Voelker, Geoffrey M Savage, Stefan Cryptography and Security Between 2021 and 2023, crypto assets valued at over \$US2.6 billion were stolen via attacks on "bridges" -- decentralized services designed to allow inter-blockchain exchange. While the individual exploits in each attack vary, a single design flaw underlies them all: the lack of end-to-end value accounting in cross-chain transactions. In this paper, we empirically analyze 10 million transactions used by key bridges during this period. We show that a simple invariant that balances cross-chain inflows and outflows is compatible with legitimate use, yet precisely identifies every known attack (and several likely attacks) in this data. Further, we show that this approach is not only sufficient for post-hoc audits, but can be implemented in-line in existing bridge designs to provide generic protection against a broad array of bridge vulnerabilities. |
| title | Count of Monte Crypto: Accounting-based Defenses for Cross-Chain Bridges |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2410.01107 |