Chapter 7

Bridge Security Models

Bridge security is not binary. Designs range from a handful of trusted signers to cryptographic proofs verified on chain. The right question is not "is it secure?" but "who must collude, and what do they gain if they cheat?" TVL in the bridge contract is the prize.

Trusted bridges move fast because verification is a signature check. They also fail catastrophically when keys leak — the Ronin hack exploited exactly that shape of trust assumption.

Trust-minimized designs cost more and take longer but shrink the trusted middle. No bridge matches the security of staying on one base layer; the goal is to know precisely what you are accepting instead of assuming parity.