Crypto is complex. We make it simple.
CORE+ Bridge Report
Crypto is complex.
We make it simple.
CORE+ Research

Bridges are inarguably big business with over 100 bridging solutions on the market and $9 billion+ held in bridges connected to Ethereum. But there are trade-offs when it comes to your security.
With the rise of new alternative layer-1 protocols (alt L1s) and Ethereum layer-2 solutions (L2s) like rollups, every chain needs a bridge to stay competitive in the crypto landscape. This scene also means dozens of different bridging implementations—and trust assumptions—security guarantees, attack vectors, and economics. Hackers and bad actors have feasted on bridges in recent years as they (typically) represent an enormous honeypot of crypto funds serving as a single point of failure between two blockchains.
Our CORE+ Bridge Report investigates ~20 top bridging solutions primarily focusing on security through the lens of:
- The "who": the entities involved in the bridge process
- The "what": the bridge architecture and what objectives it optimizes for
- The "how": how does it facilitate communication between bridges and how does it secure funds
Key Takeaways
Why Bridge At All?
- Higher yields elsewhere: Competing L1s and their dapps try to offer higher yields than competitors to incentivize user participation and provide liquidity
- Lower fees, but same EVM experience: $30 Ethereum mainnet fees can hurt your profit margin in DeFi so that you can bridge over to Avalanche, Polygon, Fantom, to do similar DeFi activities for lower fees
- Wrap or unwrap a native asset: To take possession of a native token, you may need to bridge a wrapped version of that token to the native network
Bridge Use Case
Ideally, a bridge can facilitate generalized messaging instead of just token transfers. The ability to send generalized messages/data creates the underlying communication foundation supporting data transfer and smart contract calls. This is incredibly powerful as it enables increased interoperability between dapps, new DeFi infrastructure, and distinct applications—including token bridges—to be built on top. Imagine using Ethereum’s MakerDAO from Avalanche or being able to put Yearn deposits into a Solana farm.
Bridges enable:
- the cross-chain transfer of assets and information.
- dapps to be interoperable across blockchains–thus enhancing their capabilities (as protocols now have more design space for innovation).
- unlocking liquidity between and across ecosystems.
- developers from different blockchain ecosystems to collaborate and build new platforms.
Ideal Bridge Constructions
Blockchain bridges strive for three primary characteristics:
- Security/Trust-minimization: the guarantee that information will be securely sent across the bridge without trusted third parties custodying funds, and protecting the assets on the sending chain and the receiving chain
- Liquidity and Finality: more liquidity provides a better user experience and ensures less slippage with better prices; instant finality means a faster settlement and no delay when bridging from one blockchain to another
- Native Assets: given a choice, you'd probably prefer the native asset rather than a wrapped alternative (ex: wETH.e on Avalanche, or soETH on Solana) due to the latter having less liquidity and security guarantees
Security/Vulnerabilities
However, interacting with any type of bridge carries risk (on both chains!):
- Smart Contract Risk — A bug in the code that can cause user funds to be lost
- Technology Risk — Software failure, buggy code, human error, spam, and malicious attacks can disrupt user operations
- Speed — If adequate liquidity isn’t available, users must wait until there is. This can be hours, days, or even weeks while the crypto markets continue to trade and funds are tied up
Moreover, since trusted bridges add trust assumptions, they carry additional risks, such as:
- Centralization/Censorship/Custodial Risk — Some bridges have a small set of operators that can censor and, in the worst cases, steal user funds.
- Poor security practices - Trusted third parties are human and make mistakes. As in the Ronin hack (discussed in the report), the Sky Mavis team had poor multi-sig security practices, and one individual was the victim of a social engineering hack.
Download the PDF to read the full Report
Download