Discussion about this post

User's avatar
BowTied Tarzdan's avatar

Synapse discord or BowTiedJungle discord? Can I get an invite to the latter? I'll just dump everything here for now.

I did a read of their docs and a quick security assessment is that their "cross-chain multi-party computation (MPC) validators" are by far the weakest link.

It's basically structured like an m of n multisig. m validators agree on a cross-chain transaction and then they generate the signature that unlocks funds. Who owns access to those n validators? Is it like the same guy with the root password on all n servers? None of that is clear from the current docs. The validator code is unaudited, but it's the most sensitive piece. They have a roadmap to change this to a distributed proof of stake blockchain with SYN staking, rather than MPC. That needs to be a top priority. Bridging is incredibly risky because it requires relying on the trustworthiness of something that isn't your blockchain. Ownership of the current validators needs to be transparent.

See Vitamin Butane on "the future will be *multi-chain*, but it will not be *cross-chain*". Better address that directly. Buterin talks about the risks of backed or wrapped tokens. I think Synapse addresses this by having liquidity providers in a wrapped_token<=>native_token liquidity pool take on most of that risk. Bridge users get the native token after a swap in the pool, but the liquidity providers in that pool keep holding the wrapped_token. Makes sense if fees earned from swaps on the pool compensates for the risk of being exposed to wrapped_token. If that's the case, it should be made clear to liquidity providers.

Expand full comment
Anon's avatar

Wonderful project! Looking forward to contributing, especially with data science/software engineering.

Expand full comment
22 more comments...

No posts