Why Native Bridging is a Security Mirage for Rollups

Native bridges are centralized bottlenecks. Every rollup's canonical bridge is a centralized multisig controlled by the founding team. This creates a single point of failure for billions in locked value, directly contradicting the decentralization ethos of Ethereum.

Security inherits from the weakest link. A rollup's fault or validity proofs are meaningless if the bridge can be unilaterally upgraded or drained. The security model is only as strong as its most centralized component, which is the bridge admin keys.

Compare Arbitrum and Optimism. Both use a 9-of-12 multisig for their L1 bridge contracts. This is a trusted setup identical to a custodial exchange, not a trustless protocol. The recent Across Protocol hack demonstrated how bridge logic, not the underlying chain, is the primary attack surface.

The exit game is theoretical. While users have a right to force a withdrawal via fraud proofs, the practical latency and cost make this a nuclear option, not a daily-use mechanism. In reality, users trust the bridge operators, not the cryptographic guarantees.

Native bridging is a marketing term that conflates the rollup's state transition security with the bridge's cross-chain security. The rollup's fraud-proof or validity-proof system only secures internal execution, not the external message-passing layer.

The bridge is a separate application with its own trust model and attack surface. A secure Arbitrum Nitro or Optimism Bedrock rollup can be paired with a vulnerable canonical bridge, creating a single point of failure for all cross-chain value.

Evidence: The 2022 Nomad bridge hack exploited a bug in the bridge's message verification, not the underlying rollup. This demonstrates that bridge security is an independent variable from the L2's consensus and execution security.

The proxy is the root. Every major rollup like Arbitrum and Optimism uses a proxy pattern for its core bridge contract on Ethereum. This separates the contract's logic from its storage, allowing for upgrades.

Upgradeability equals centralization. The proxy admin key held by the rollup team controls this upgrade mechanism. This key can unilaterally change bridge logic, freeze funds, or mint arbitrary tokens on the L2.

Security is illusory. While the bridge's current code may be trust-minimized, its future state is not. This makes the security model contingent on the key holder's honesty, not cryptographic guarantees.

Evidence: The Multichain exploit demonstrated this risk. Its proxy-admin compromise led to a $130M loss, proving that proxy keys are a high-value attack vector for any bridge, native or otherwise.

Timelocks are not trustless. A governance-controlled upgrade path, even with a delay, centralizes final trust in the multisig signers. This recreates the custodial risk of a traditional bridge, just with a committee and a waiting period.

Security councils are single points of failure. Models like Arbitrum's Security Council or Optimism's Foundation are human-governed kill switches. Their existence proves the underlying system is not credibly neutral and can be unilaterally changed.

Governance minimizes, not eliminates, trust. The attack vector shifts from a live exploit to a governance attack or coercion of council members. This is a political risk, not a cryptographic guarantee.

Evidence: The 2022 Nomad Bridge hack exploited a governance-upgradable contract. While not a rollup, it exemplifies the risk pattern where upgrade authority is the root vulnerability, a flaw shared by all governance-dependent bridges.