L2BEAT Bridges is a work in progress. You might find incomplete research or inconsistent naming. Join our Discord to suggest improvements!
Allbridge
About
Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins using liquidity pools.
About
Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins using liquidity pools.
Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins using liquidity pools.
For its stablecoin liquidity network it is using either of its own AMB, Circle CCTP or Wormhole to pass messages. Allbridge TokenBridge is a token bridge implemented as a separate contract. Core system parameters can be changed by an EOA, risking the loss of all funds stored in the system contracts.
Funds can be stolen if
- the Wormhole guardians and / or Allbridge validators allow to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL),
- the Wormhole guardians and / or Allbridge validators sign a fraudulent message allowing themselves to withdraw all locked funds (CRITICAL),
- the source code of unverified contracts contains malicious code (CRITICAL).
Principle of operation
For USDC and USDT, Allbridge ‘Core’ offers three message protocols (AMBs) to choose from: Allbridge, Wormhole and Circle CCTP (USDC only). These two token classes can also simultaneously be swapped while bridging, tapping into the Allbridges multichain liquidity pools.
For other supported tokens, Allbridge offers a token bridge mode that locks tokens in the escrow on Ethereum and mints them at the destination. The crosschain messages in this case are passed via either Allbridge AMB or Wormhole.
Transfers are externally verified
Validation process takes place in external network called the Guardian Network. Nodes in the network, called Guardians, observe the Core Contract on each supported chain and produce VAAs (Verified Action Approvals, essentially signed messages) when those contracts receive an interaction. Based on the VAA user can withdraw funds on the other end of the bridge.
Users can be censored if the circle oracle network fails to facilitate a transfer via the Circle CCTP (CRITICAL).
Users can be censored if the Wormhole guardians and / or Allbridge validators decide to stop processing certain transactions (CRITICAL).
Funds can be stolen if the Wormhole guardians and / or Allbridge validators allow to mint more tokens than there are locked on Ethereum thus preventing some existing holders from being able to bring their funds back to Ethereum (CRITICAL).
Funds can be stolen if the Wormhole guardians and / or Allbridge validators sign a fraudulent message allowing themselves to withdraw all locked funds (CRITICAL).
The system uses the following set of permissioned addresses:
Allowed to grant and revoke all roles in the TokenBridge (Can steal all funds).
Allowed to set Validators, unlockSigners and unpause in the TokenBridge (Can steal all funds).
Allowed add and remove token support in the TokenBridge.
Can pause the TokenBridge.
Owner of all system contracts except TokenBridge, privileged to update messengers and other bridge parameters. As a result this account can drain all funds from the pools.
EOA delivering crosschain messages to the AllbridgeMessenger contract.
EOA delivering crosschain messages to the WormholeMessenger contract.
EOA delivering crosschain messages to the WormholeMessenger contract.
The system consists of the following smart contracts on the host chain (Ethereum):
The main contract for the Allbridge liquidity network.
The main contract for the Allbridge token bridge. This contract can store any token.
This contract is responsible for validating incoming messages to the token bridge. The source code of this contract is not verified on Etherscan.
This contract is responsible for calculating bridge fees. The source code of this contract is not verified on Etherscan.
This contract is responsible for calculating crosschain gas fees.
Contract used to receive messages via allbridge AMB.
Contract used to receive messages via Wormhole AMB.
Contract used to receive messages via Circle CCTP.
Value Locked is calculated based on these smart contracts and tokens:
Lock-Mint token bridge
USDT liquidity pool on Ethereum
USDC liquidity pool on Ethereum
The current deployment carries some associated risks:
Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).