Uniswap Bridge Assessment Framework (Governance Usecase)

	A	B	C	D	E
1	Risk		Due Diligence
2	Source	Potential Impact	Checks	Importance

3	Validation Protocol	Safety, Liveness, Censorship			Validation Protocol Desired Properties
4	Size and Threshold	Severe	Is the role of protocol validator permissioned or permissionless?	Medium	From the perspective of safety, a desirable configuration for protocols with any type of validation mechanism is: - A sizable number of validators with a +2/3 threshold for signing messages - All validators actively participate in attesting, and the validator selection mechanism enables and enforces this. - All validators actively and independently observe and validate crosschain messages + For bridges with a Proof-of-Stake validation mechanism: - The protocol offers strong cryptoeconomic guarantees: Validators stake assets that have significant value and low-volatility, slashing conditions are clear and enforceable by anyone, token ownership is distributed and not concentrated - Validators have strong competence in operating secure infrastructure - The economics of operating the bridge are sustainable. This ensures that the security properties assessed are sustainable + For bridges with a Proof-of-Authority validation mechanism: - Validators have a strong reputation within the community - Validators are legally and operationally distinct entities - Validators are governed by plausibly enforceable contractual obligations - Validators have strong competence in operating secure infrastructure - All validators actively participate in attesting - All validators actively and independently observe and validate crosschain messages - The economics of operating the bridge are sustainable. This ensures that the security properties assessed are sustainable + For bridges with an optimistic validation mechanism: - A long fraud window - Significant value staked by attestor(s)/updater - Clear slashing conditions that are enforceable by anyone - Permissionless watcher set on the source and destination chains - Strong incentives for watchers to observe and verify the state of crosschain messages across all chains, with additional MEV protection for fraud reports. - Mitigations (e.g. penalties) for arbitrary protocol halts resulting from invalid proofs The worst scenario for both PoS and PoA bridges is that invalid governance messages could be submitted and processed on destination chains. This is also the case for bridges that employ an optimistic security model with the additional scenario of critical governance messages not being delivered in time.
5			How many distinct validators does the protocol have? Are there different types of validators, in terms of role and capability?	High
6			What are the specific honesty threshold assumptions for guaranteeing safety?	High
7			What threshold of validators can compromise liveness?	High
8			Do all validators validate all chain? If not, are the validator sizes and thresholds for the prominent EVM chains that Uniswap is deployed on different than those discussed above?	High
9			Does the protocol utilise an underlying chain that coordinates validators? What are the safety and liveness properties of this chain? How does this impact the overall security property of the protocol?	High
10			How does the protocol respond to active misbehaviour by a quorum of validators (e.g. Can a minority halt the bridge to mitigate impact? Can the majority still be slashed or penalised?)? What are the other security implications of such mechanisms?	High
11			Are these validators shared for all applications? If not, what are the assumptions and implications to the safety and liveness guarantees discussed above?	High
12			Are there any plans to change the size of the validator set in the near term?	High
13			Do destination chains have to keep track of changes to the validator set? If so, and this is a permissionless chain, how is this accomplished? What are the limitations of this approach?	High
14			Can all the above parameters of the protocol be verified on-chain?	High
15	Cryptoeconomic Guarantees	Safety, Liveness, Censorship
16	Stake Distribution	Severe	What is the minimum amount that a validator needs to stake?	High
17			How much value is staked by validators collectively?	High
18			How distributed is stake across validators?	High
19			What is the minimum number of entities that have sufficient stake to compromise safety and liveness? How much staked value secures safety, and liveness?	High
20			How does the protocol mitigate centralisation of stake distribution? (e.g. quadratic voting model)	High
21	Staked Asset	Medium-High	What is the asset staked? Is this a bridge-specific token? How liquid is the token?	Medium
22			What are the dynamics that drive the value of such tokens?	Medium
23			How likely is it that the price of this token can be manipulated to significantly alter the cryptoeconomic security of this protocol? Are there mitigations against this?	High
24			How does the total value of staked asset by a quorum of validators compare against the assets secured by the bridge?	High
25	Slashing	High	Does the protocol employ a slashing mechanism?	High
26			What are the slashable conditions? Do these slashing conditions cover both safety and liveness related faults?	High
27			What are the mechanics of this approach? Does it protect against a quorum of validators deviating from the protcol? Can validators bypass the slashing mechanism in any way? If so, under what scenarios?	High
28			How much value is slashed for each type of infraction? Under what conditions is a validator evicted?	High
29			Is the history of slashing events publicly visible? Are there obvious concerns that stand out?	High
30			How much time is needed for a validator or delegator to undelegate?	High
31			Can anyone observe and report slashable behaviour or just other validators?	Medium
32			Are entities that report slashable behaviour adequately incentivized to do so?	Medium
33	Attacks	High	What would be the economic cost of bribing a threshold of validators to compromise safety?	High
34			What would be the cost of bribing a threshold of validators to compromise liveness?	High
35			If the validator set is permissionless, how feasible is it for an attacker to purchase sufficient stake in the asset staked by validators, become a validator, compromise the bridge and gain significant net profit, in a short period of time? What controls exist to mitigate this?	High
36			Does the protocol have plausible mitigations against sophisticated cryptoeconomic attacks?	High
37	Optimistic Mechanism	Safety, Liveness, Censorship	Note:Ignore this section if the protocol does not employ an optimistic verification scheme.
38	Attestors	High	How many entities attest to transactions? Can these entities break liveness or censor messages?	High
39	Watchers	Severe	How long is the fraud reporting window?	High
40			Is the watcher role permissionless? If not, how many watchers are watching the network to detect fraudulent transactions?	High
41			Can a watcher report invalid fraud to grief the network, and compromise liveness? What are the mitigations against this?	High
42			How is fraud resolved on the destination chain? Is there an automated mechanism or does require manual intervention?	High
43			How are watchers incentivized? Is the model sustainable? How does the protocol ensure watchers do not get front-run?	High
44	Relayers	Safety, Liveness
45	Entities	Severe	Who relays crosschain messages? Can any party submit a verifiable crosschain message to the destination chain or only validators? What are the trust assumptions placed on this entity?	High
46			How are these parties economically incentivized?	Medium
47			Who pays for destination chain transactions? Are there assumptions in this that don’t hold, if gas prices spike?	Medium
48	Censorship Resistance	Censorship Resistance
49	Censorship	Medium-High	Can validators or relayers censor messages? How many validators need to participate to effectively censor a message?	High
50			What is the granularity of censorship?	High
51			What controls are in place for mitigating censorship?	High
52	Validator Participation	Safety, Liveness			Effective Validator Set
53	Participation	High	Are all validators demonstrably active in attesting to messages or are subset persistently passive?	High	An implicit assumption in external validator based protocols is that validators are actively participating. This implies two things 1) validators are independently verifying whether cross-chain messages are valid before attesting to them 2) validators are participating in the message attestation process in a consistent and timely manner. A protocol’s “effective validator set” is the set of validators that can be shown to be performing both 1 and 2 through off-chain evidence or through mechanisms built into the protocol that ensure these behaviours. While 1, is an important consideration from a safety perspective, 2 is a liveness concern.
54			How do validators coordinate attestations? Is there a clear mechanism that ensures active participation by all validators? Is there clear evidence that this is occurring?	High
55			Is there a protocol-level mechanism that ensures that validators independently observe and verify messages? (i.e. addressing a possible verifier's dilemma problem)	High
56	Validation Protocol - Structural Assurances	Safety, Liveness
57	Reputation & Calibre	Severe	If the security of the protocol assumes reputable validators:
58			Who are the validators? What is their core business?	High
59			Are there clear indicator of the size and caliber of the business and its reputation within the community?	High
60			Is there a conflict of interest between the operations of their business and their role as bridge validators?	Medium
61	Legal Recourse	Medium-High	If the security of the protocol relies on legal recourse as a disincentive to validators misbehaving:
62			Are there contractual terms governing the operation of these entities?	Medium
63			In what jurisdiction are these contracts enforced?	Medium
64			In what jurisdictions are validators domiciled?	Medium
65	Validator Interdependence	High	If the validators are known legal entities, are there any relationships between these entities (e.g. parent-subsidiary)	High
66	Validator Interdependence	High	If the validators are unknown entities, is there a mechanism that ensures that there are enough distinct entities in the validator set?	High
67	Incentives	Medium-High	What is the economic model incentivizing the operation of validators? Is this sustainable?	High
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100