Document Open Access Logo

Trustless Bridges via Random Sampling Light Clients

Authors Bhargav Nagaraja Bhatt , Fatemeh Shirazi, Alistair Stewart

PDF

File

Thumbnail PDF
PDF
LIPIcs.AFT.2025.31.pdf
  • Filesize: 0.88 MB
  • 24 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Distributed systems security
Keywords
  • PoS Blockchains
  • Trustless Bridges
  • Light Clients
  • Decentralised Relayers
  • RANDAO Bias

Metrics

  • Access Statistics
  • Total Accesses (updated on a weekly basis)
    0
    PDF Downloads
    0
    Metadata Views

Abstract

The increasing number of blockchain projects introduced annually has led to a pressing need for secure and efficient interoperability solutions. Currently, the lack of such solutions forces end-users to rely on centralized intermediaries, contradicting the core principle of decentralization and trust minimization in blockchain technology. We propose a decentralized and efficient interoperability solution (aka Bridge Protocol) that operates without additional trust assumptions, relying solely on the Byzantine Fault Tolerance (BFT) properties of the two chains being connected. In particular, relayers (actors that exchange messages between networks) are permissionless and decentralized, hence eliminating any single point of failure. We introduce Random Sampling, a novel technique for on-chain light clients to efficiently follow the history of PoS blockchains by reducing the signature verifications required. Here, the randomness is drawn on-chain, for example, using Ethereum’s RANDAO. We analyze the security of the bridge from a crypto- economic perspective and provide a framework to derive the security parameters. This includes handling subtle concurrency issues and randomness bias in strawman designs. While the protocol is applicable to various PoS chains, we demonstrate the protocol’s practical feasibility by showcasing an instantiated bridge between Polkadot and Ethereum (currently deployed), and discuss some practical security challenges. Furthermore, we evaluate the efficiency of our on-chain light client verifier (implemented as an Ethereum smart contract) against SNARK-based approaches, demonstrating significantly lower gas costs for signature verification - even for validator sets up to 10⁶.

Cite As Get BibTex

Bhargav Nagaraja Bhatt, Fatemeh Shirazi, and Alistair Stewart. Trustless Bridges via Random Sampling Light Clients. In 7th Conference on Advances in Financial Technologies (AFT 2025). Leibniz International Proceedings in Informatics (LIPIcs), Volume 354, pp. 31:1-31:24, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2025) https://doi.org/10.4230/LIPIcs.AFT.2025.31

Author Details

Bhargav Nagaraja Bhatt
  • Web3 Foundation, Zug, Switzerland
Fatemeh Shirazi
  • Web3 Foundation, Zug, Switzerland
Alistair Stewart
  • Web3 Foundation, Zug, Switzerland

Acknowledgements

We thank Aidan Musnitzky, Alistair Singh, and Vincent Geddes from Snowfork and the Bridge team at Parity Technologies for fruitful discussions on practical challenges in implementation. We also thank Jeffrey Burdges, Robert Hambrock, and Syed Hosseini for useful feedback and for reviewing drafts of this work. Lastly, we thank Alfonso Cevallos and Handan Kilinç Alper for their involvement in the early stages of the project.

References

  1. Shresth Agrawal, Joachim Neu, Ertem Nusret Tas, and Dionysis Zindros. Proofs of proof-of-stake with sublinear complexity. CoRR, abs/2209.08673, 2022. URL: https://doi.org/10.48550/arXiv.2209.08673.
  2. Kaya Alpturer and S. Matthew Weinberg. Optimal randao manipulation in ethereum, 2024. URL: https://doi.org/10.48550/arXiv.2409.19883.
  3. Altair light client - sync protocol. https://ethereum.github.io/consensus-specs/specs/altair/light-client/sync-protocol/, 2024.
  4. Anonymised Artifact. Randao analysis. https://anonymous.4open.science/r/fc25-randao-analysis-AFCD/, 2025.
  5. André Augusto, Rafael Belchior, Miguel Correia, André Vasconcelos, Luyao Zhang, and Thomas Hardjono. Sok: Security and privacy of blockchain interoperability. In 2024 IEEE Symposium on Security and Privacy (SP), pages 3840-3865, 2024. URL: https://doi.org/10.1109/SP54263.2024.00255.
  6. Axelar: Connecting applications with blockchain ecosystems. https://www.axelar.network/whitepaper, 2021.
  7. Polkadot Specifications: Beefy. https://spec.polkadot.network/sect-finality#sect-grandpa-beefy, 2023.
  8. Eli Ben-Sasson, Alessandro Chiesa, and Nicholas Spooner. Interactive oracle proofs. In Martin Hirt and Adam D. Smith, editors, Theory of Cryptography - 14th International Conference, TCC 2016-B, Beijing, China, October 31 - November 3, 2016, Proceedings, Part II, volume 9986 of Lecture Notes in Computer Science, pages 31-60, 2016. URL: https://doi.org/10.1007/978-3-662-53644-5_2.
  9. Adithya Bhat, Nibesh Shrestha, Aniket Kate, and Kartik Nayak. RandPiper - reconfiguration-friendly random beacons with quadratic communication. Cryptology ePrint Archive, Paper 2020/1590, 2020. URL: https://doi.org/10.1145/3460120.3484574.
  10. Joseph Bonneau, Izaak Meckler, Vanishree Rao, and Evan Shapiro. Coda: Decentralized cryptocurrency at scale. IACR Cryptol. ePrint Arch., page 352, 2020. URL: https://eprint.iacr.org/2020/352.
  11. Ethan Buchman, Jae Kwon, and Zarko Milosevic. The latest gossip on BFT consensus. CoRR, abs/1807.04938, 2018. URL: https://arxiv.org/abs/1807.04938.
  12. Benedikt Bunz, Lucianna Kiffer, Loi Luu, and Mahdi Zamani. Flyclient: Super-light clients for cryptocurrencies. In 2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18-21, 2020, pages 928-946. IEEE, 2020. URL: https://doi.org/10.1109/SP40000.2020.00049.
  13. Jeff Burdges, Alfonso Cevallos, Peter Czaban, Rob Habermeier, Syed Hosseini, Fabio Lama, Handan Kilinç Alper, Ximin Luo, Fatemeh Shirazi, Alistair Stewart, and Gavin Wood. Overview of polkadot and its design considerations. CoRR, abs/2005.13456, 2020. URL: https://arxiv.org/abs/2005.13456.
  14. Vitalik Buterin. A griefing factor analysis model. https://ethresear.ch/t/a-griefing-factor-analysis-model/2338, 2018.
  15. Vitalik Buterin and Virgil Griffith. Casper the friendly finality gadget. CoRR, abs/1710.09437, 2017. URL: https://arxiv.org/abs/1710.09437.
  16. Ran Canetti, Ben Riva, and Guy N. Rothblum. Refereed delegation of computation. Information and Computation, 226:16-36, 2013. Special Issue: Information Security as a Resource. URL: https://doi.org/10.1016/j.ic.2013.03.003.
  17. Miguel Castro and Barbara Liskov. Practical byzantine fault tolerance. In Margo I. Seltzer and Paul J. Leach, editors, Proceedings of the Third USENIX Symposium on Operating Systems Design and Implementation (OSDI), New Orleans, Louisiana, USA, February 22-25, 1999, pages 173-186. USENIX Association, 1999. URL: https://dl.acm.org/citation.cfm?id=296824.
  18. Pyrros Chaidos, Aggelos Kiayias, Leonid Reyzin, and Anatoliy Zinovyev. Approximate lower bound arguments. In Marc Joye and Gregor Leander, editors, Advances in Cryptology - EUROCRYPT 2024 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zurich, Switzerland, May 26-30, 2024, Proceedings, Part IV, volume 14654 of Lecture Notes in Computer Science, pages 55-84. Springer, 2024. URL: https://doi.org/10.1007/978-3-031-58737-5_3.
  19. Chainalysis. Vulnerabilities in cross-chain bridge protocols emerge as top security risk. https://www.chainalysis.com/blog/cross-chain-bridge-hacks-2022/ , 2022.
  20. Stefanos Chaliasos, Jens Ernstberger, David Theodore, David Wong, Mohammad Jahanara, and Benjamin Livshits. Sok: what don't we know? understanding security vulnerabilities in snarks. In Proceedings of the 33rd USENIX Conference on Security Symposium, SEC '24, USA, 2024. USENIX Association. URL: https://www.usenix.org/conference/usenixsecurity24/presentation/chaliasos.
  21. Stefanos Chaliasos, Jens Ernstberger, David Theodore, David Wong, Mohammad Jahanara, and Benjamin Livshits. Sok: What don't we know? understanding security vulnerabilities in snarks. CoRR, abs/2402.15293, 2024. URL: https://doi.org/10.48550/arXiv.2402.15293.
  22. Herman Chernoff. A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations. The Annals of Mathematical Statistics, 23(4):493-507, 1952. URL: https://doi.org/10.1214/aoms/1177729330.
  23. Kevin Choi, Aathira Manoj, and Joseph Bonneau. Sok: Distributed randomness beacons. In 2023 IEEE Symposium on Security and Privacy (SP), pages 75-92, 2023. URL: https://doi.org/10.1109/SP46215.2023.10179419.
  24. Oana Ciobotaru, Fatemeh Shirazi, Alistair Stewart, and Sergey Vasilyev. Accountable light client systems for pos blockchains. IACR Cryptol. ePrint Arch., page 1205, 2022. URL: https://eprint.iacr.org/2022/1205.
  25. Ronald Cramer. Modular design of secure yet practical cryptographic protocols. Ph. D.-thesis, CWI and U. of Amsterdam, 2, 1996. Google Scholar
  26. Ben Edgington. One page annotated spec. https://eth2book.info/capella/annotated-spec/ , 2022.
  27. Ben Edgington. Upgrading Ethereum, chapter RANDAO Biasability, pages 152-153. Ben Edgington, 2023. URL: https://eth2book.info/capella/part2/building_blocks/randomness/#randao-biasability.
  28. Over $1 billion stolen from bridges so far in 2022 as harmonys horizon bridge becomes latest victim in $100 million hack, 2022. URL: bit.ly/3fvlIME.
  29. Nomad loses $156 million in seventh major crypto exploit of 2022. https://hub.elliptic.co/analysis/nomad-loses-156-million-in-seventh-major-crypto-bridge-exploit-of-2022/, 2022.
  30. Peter Gazi, Aggelos Kiayias, and Dionysis Zindros. Proof-of-stake sidechains. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019, pages 139-156. IEEE, 2019. URL: https://doi.org/10.1109/SP.2019.00040.
  31. Vincent Geddes and Aidan Musnitsky. Snowfork’s analysis of sync committee security. https://forum.polkadot.network/t/snowforks-analysis-of-sync-committee-security/2712/10, 2023.
  32. Craig Gentry, Shai Halevi, and Vadim Lyubashevsky. Practical non-interactive publicly verifiable secret sharing with thousands of parties. ePrint 2021/1397, 2021. URL: https://eprint.iacr.org/2021/1397.
  33. Jens Groth. Non-interactive distributed key generation and key resharing. ePrint 2021/339, 2021. URL: https://eprint.iacr.org/2021/339.
  34. Kobi Gurkan, Philipp Jovanovic, Mary Maller, Sarah Meiklejohn, Gilad Stern, and Alin Tomescu. Aggregatable distributed key generation. ePrint 2021/005, 2021. URL: https://eprint.iacr.org/2021/005.
  35. Mor Harchol-Balter. Introduction to probability for computing. https://www.cs.cmu.edu/~harchol/Probability/chapters/chpt18.pdf, 2024.
  36. Rongjian Lan, Ganesha Upadhyaya, Stephen Tse, and Mahdi Zamani. Horizon: A gas-efficient, trustless bridge for cross-chain transactions. CoRR, abs/2101.06000, 2021. URL: https://arxiv.org/abs/2101.06000.
  37. Arjen K. Lenstra and Benjamin Wesolowski. A random zoo: sloth, unicorn, and trx. Cryptology ePrint Archive, Paper 2015/366, 2015. URL: https://eprint.iacr.org/2015/366.
  38. Lu Liu, Sicong Zhou, Huawei Huang, and Zibin Zheng. From technology to society: An overview of blockchain-based dao. IEEE Open Journal of the Computer Society, 2:204-215, 2021. URL: https://doi.org/10.1109/OJCS.2021.3072661.
  39. Giulio Malavolta, Pedro Moreno-Sanchez, Clara Schneidewind, Aniket Kate, and Matteo Maffei. Anonymous multi-hop locks for blockchain scalability and interoperability. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019. The Internet Society, 2019. URL: https://www.ndss-symposium.org/ndss-paper/anonymous-multi-hop-locks-for-blockchain-scalability-and-interoperability/.
  40. Silvio Micali, Leonid Reyzin, Georgios Vlachos, Riad S. Wahby, and Nickolai Zeldovich. Compact certificates of collective knowledge. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, pages 626-641. IEEE, 2021. URL: https://doi.org/10.1109/SP40001.2021.00096.
  41. Michael Neuder, Daniel J. Moroz, Rithvik Rao, and David C. Parkes. Low-cost attacks on ethereum 2.0 by sub-1/3 stakeholders. CoRR, abs/2102.02247, 2021. URL: https://arxiv.org/abs/2102.02247.
  42. Nomad protocol. https://docs.nomad.xyz/the-nomad-protocol/overview, 2021.
  43. Polkadot Wiki: Treasury. https://wiki.polkadot.network/docs/learn-polkadot-opengov-treasury , 2024.
  44. James Preswitch. Altair has no light client. https://prestwich.substack.com/p/altair , 2023.
  45. Ethereum Foundation Protocol Support Team. Dencun mainnet announcement. https://blog.ethereum.org/2024/02/27/dencun-mainnet-announcement, 2024.
  46. What is the rainbow bridge? https://doc.aurora.dev/bridge/introduction/, 2024.
  47. Rekt leaderboard. https://rekt.news/tr/leaderboard/, 2024.
  48. Ronin bridge documentation. https://docs.roninchain.com/apps/ronin-bridge, 2024.
  49. Giulia Scaffino, Lukas Aumayr, Mahsa Bastankhah, Zeta Avarikioti, and Matteo Maffei. Alba: The dawn of scalable bridges for blockchains. IACR Cryptol. ePrint Arch., page 197, 2024. URL: https://eprint.iacr.org/2024/197.
  50. Philipp Schindler, Aljosha Judmayer, Markus Hittmeir, Nicholas Stifter, and Edgar Weippl. RandRunner: Distributed randomness from trapdoor VDFs with strong uniqueness. Cryptology ePrint Archive, Paper 2020/942, 2020. URL: https://eprint.iacr.org/2020/942.
  51. Philipp Schindler, Aljosha Judmayer, Nicholas Stifter, and Edgar Weippl. Hydrand: Efficient continuous distributed randomness. In 2020 IEEE Symposium on Security and Privacy (SP), pages 73-89, 2020. URL: https://doi.org/10.1109/SP40000.2020.00003.
  52. Caspar Schwarz-Schilling, Joachim Neu, Barnabé Monnot, Aditya Asgaonkar, Ertem Nusret Tas, and David Tse. Three attacks on proof-of-stake ethereum. In Ittay Eyal and Juan A. Garay, editors, Financial Cryptography and Data Security - 26th International Conference, FC 2022, Grenada, May 2-6, 2022, Revised Selected Papers, volume 13411 of Lecture Notes in Computer Science, pages 560-576. Springer, 2022. URL: https://doi.org/10.1007/978-3-031-18283-9_28.
  53. Snowbridge: A trustless bridge between polkadot and ethereum. https://github.com/snowfork/snowbridge/, 2024.
  54. Alistair Stewart and Eleftherios Kokoris-Kogia. GRANDPA: a byzantine finality gadget. CoRR, abs/2007.01560, 2020. URL: https://arxiv.org/abs/2007.01560.
  55. Alex Stokes, Ansgar Dietrichs, Danny Ryan, Martin Holst Swende, and lightclient. Eip-4788: Beacon block root in the evm. https://eips.ethereum.org/EIPS/eip-4788 , 2022.
  56. Peter Todd. Making utxo set growth irrelevant with low-latency delayed txo commitments. https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-May/012715.html, 2016.
  57. Dmytro Tymokhanov and Omer Shlomovits. Alpha-rays: Key extraction attacks on threshold ECDSA implementations. Cryptology ePrint Archive, Paper 2021/1621, 2021. URL: https://eprint.iacr.org/2021/1621.
  58. Ultraplonk verifier by aztec. https://github.com/AztecProtocol/barretenberg/tree/master/sol/src/ultra, 2024.
  59. Paul Van Vulpen and Slinger Jansen. Decentralized autonomous organization design for the commons and the common good. Frontiers in Blockchain, 6:1287249, 2023. URL: https://doi.org/10.3389/FBLOC.2023.1287249.
  60. Psi Vesely, Kobi Gurkan, Michael Straka, Ariel Gabizon, Philipp Jovanovic, Georgios Konstantopoulos, Asa Oines, Marek Olszewski, and Eran Tromer. Plumo: An ultralight blockchain client. In Ittay Eyal and Juan A. Garay, editors, Financial Cryptography and Data Security - 26th International Conference, FC 2022, Grenada, May 2-6, 2022, Revised Selected Papers, volume 13411 of Lecture Notes in Computer Science, pages 597-614. Springer, 2022. URL: https://doi.org/10.1007/978-3-031-18283-9_30.
  61. Gavin Wood et al. Ethereum: A secure decentralised generalised transaction ledger. Ethereum project yellow paper, 151(2014):1-32, 2014. Google Scholar
  62. Wormhole architecture overview. https://wormhole.com/docs/learn/fundamentals/architecture/, 2024.
  63. Tiancheng Xie, Jiaheng Zhang, Zerui Cheng, Fan Zhang, Yupeng Zhang, Yongzheng Jia, Dan Boneh, and Dawn Song. zkbridge: Trustless cross-chain bridges made practical. In Heng Yin, Angelos Stavrou, Cas Cremers, and Elaine Shi, editors, Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022, pages 3003-3017. ACM, 2022. URL: https://doi.org/10.1145/3548606.3560652.
  64. Alexei Zamyatin, Dominik Harz, Joshua Lind, Panayiotis Panayiotou, Arthur Gervais, and William J. Knottenbelt. XCLAIM: trustless, interoperable, cryptocurrency-backed assets. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019, pages 193-210. IEEE, 2019. URL: https://doi.org/10.1109/SP.2019.00085.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2025 Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact