L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our Discord to suggest improvements!
Portal (Wormhole)
About
The Portal token bridge is built on top of Wormhole, a message passing protocol for enabling and validating cross-chain communication.
About
The Portal token bridge is built on top of Wormhole, a message passing protocol for enabling and validating cross-chain communication.
Wormhole introduces NTT for $W
2024 Apr 25th
Native Token Transfers (NTT) is a multichain composable token standard developed by Wormhole.
The Portal token bridge is built on top of Wormhole, a message passing protocol for enabling and validating cross-chain communication.
Funds can be stolen if
- guardians allow to mint more tokens than there are locked on Ethereum, preventing some existing holders from being able to bring their funds back to Ethereum,
- guardians sign a fraudulent message allowing themselves to withdraw all locked funds,
- the destination token contract is maliciously upgraded,
- a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).
Users can be censored if
Principle of operation
This is a type of Token Bridge that locks tokens in the escrow contracts on the source chain and mints tokens at the destination. What differentiates this solution is that the cross-chain message is sent via the Wormhole protocol, in which emitted messages on one chain are observed by a network of nodes (Wormhole: Guardians) and then verified. After its verification, the message is submitted to the destination chain for processing. Since the Guardian network is essential to the security of the Wormhole protocol, Guardians can tap into additional sources of truth apart from the events emitted at the source chain. The Wormhole Gateway, a Cosmos-SDK chain, serves as a hub that can perform additional standardized checks on metadata like VAA format and global token balances and flows.
Transfers are externally verified
Validation process takes place in an external network called the Guardian Network. Nodes in the network, called Guardians, observe the Core Contract on each supported chain and produce VAAs (Verified Action Approvals, essentially signed messages) when those contracts receive an interaction. Based on a threshold of VAAs, users can withdraw funds on the other end of the bridge.
Users can be censored if guardians decide to stop processing certain transactions.
Funds can be stolen if guardians allow to mint more tokens than there are locked on Ethereum, preventing some existing holders from being able to bring their funds back to Ethereum.
Funds can be stolen if guardians sign a fraudulent message allowing themselves to withdraw all locked funds.
Destination tokens
The type of token received on the destination chain depends on the token: If it is native to this chain, the user will receive the canonical token. If the bridged token is not native to the destination chain the user will receive a wrapped version. The token contract in this case is called BridgeToken and is upgradable.
Funds can be stolen if the destination token contract is maliciously upgraded.
The system uses the following set of permissioned addresses:
Off-chain actors signing messages (VAAs) containing transfer information or governance actions such as upgrades, which are decoded onchain with signature checks.
The system consists of the following smart contracts on the host chain (Ethereum):
Governance contract storing the current Guardian set and providing a facility to verify cross-chain messages by verifying Guardians signatures. Guardians themselves can choose a new Guardian set. Can be upgraded by Guardians.
Main bridge contract on Ethereum and an escrow for ETH and ERC20 tokens that were bridged to other chains. Can be upgraded by Guardians. This contract can store any token.
This is the template for BridgedToken implementations minted by Portal on Ethereum.
NFT bridge contract and an escrow for NFTs that were bridged to other chains. Can be upgraded by Guardians.
This is the template for bridged NFTs minted by Portal on Ethereum.
The current deployment carries some associated risks:
Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).
