Non-Custodial Bridge

A non-custodial bridge eliminates the need for a trusted third party. Users retain control of their assets via smart contracts on both chains. The security of the transfer depends on the underlying cryptographic proofs (like zero-knowledge proofs or optimistic verification) and the consensus of the source chain, rather than the honesty of a bridge operator.

This is a foundational mechanism for peer-to-peer, non-custodial transfers. An HTLC uses a cryptographic hash and time lock to ensure the swap either completes atomically or funds are returned.

• A user locks Asset A on Chain 1 with a secret hash.
• A counterparty locks Asset B on Chain 2, providing the same hash proof.
• The original user reveals the secret to claim Asset B, which simultaneously allows the counterparty to claim Asset A.
• If the time expires, all funds are refunded.

These bridges use decentralized pools of liquidity on both chains, facilitated by automated market makers (AMMs). When a user bridges an asset, they are not waiting for a 1:1 counterparty swap. Instead:

• The asset is deposited into a liquidity pool on the source chain.
• A relay provides a cryptographic proof of this deposit.
• An equivalent amount is minted or released from a pool on the destination chain. Security relies on the economic security of the relay and the integrity of the state proof.

A common pattern where the native asset is locked in a verifiable smart contract on the source chain (e.g., Ethereum), and a wrapped, canonical representation is minted on the destination chain (e.g., Polygon).

• The canonical wrapped token (like WETH on Polygon) is the only 'official' bridged version, ensuring composability.
• To return, the wrapped token is burned, and a proof unlocks the original.
• Security is derived from the verification of the source chain's state, often via light clients or fraud proofs.

The most decentralized verification method. A light client of the source chain (e.g., Ethereum) runs on the destination chain. This client verifies block headers and Merkle proofs of transactions. When a user deposits funds, they submit a Merkle proof to the light client contract, which validates the transaction's inclusion and finality against the source chain's consensus. This makes the bridge's security a direct function of the underlying chain's security.

Inspired by optimistic rollups, these bridges assume state transitions are valid but include a challenge period. A relayer submits a claim that assets have been locked on Chain A and can be minted on Chain B. During the challenge window, any watcher can submit a fraud proof with cryptographic evidence to invalidate a false claim. This 'verify-by-challenge' model reduces operational costs while maintaining strong security assumptions.

This model uses light clients (simplified blockchain verifiers) to validate state proofs from the source chain. A network of independent relayers submits these proofs to the destination chain's smart contract for verification. Security is derived from the underlying chain's consensus, making it highly trust-minimized. Examples include the IBC protocol and some optimistic bridge designs.

• Key Mechanism: Cryptographic state proofs verified on-chain.
• Trust Assumption: Security of the connected blockchains.
• Example: Cosmos IBC.

Inspired by optimistic rollups, this model assumes all state transitions are valid unless challenged. A single attester proposes a cross-chain state root, which enters a challenge period. Watchtowers or any participant can submit fraud proofs during this window to slash the attester's bond. This reduces operational costs but introduces a withdrawal delay.

• Key Mechanism: Fraud proofs and economic bonds.
• Trust Assumption: At least one honest watcher exists.
• Trade-off: Security for latency (e.g., 30-minute challenge periods).

A decentralized network of signers uses Multi-Party Computation (MPC) to collectively manage bridge assets. No single party holds the full private key; a threshold (e.g., 8 of 15) must collaborate to sign transactions. This distributes trust but introduces an off-chain consensus layer with its own validator set and economic security.

• Key Mechanism: Distributed key generation and threshold signatures.
• Trust Assumption: Honest majority of the MPC committee.
• Example: ThorChain, Multichain (formerly Anyswap).

Also known as Lock & Mint / Burn & Mint bridges, these models use a canonical token on the destination chain backed by locked collateral. When bridging from Chain A to B, tokens are locked in a vault on A, and an equivalent wrapped token is minted on B. The reverse process burns the wrapped token to unlock the original. Security depends on the vault's custodian model (often MPC or multisig).

• Key Mechanism: Asset encapsulation via locking/minting.
• Primary Use: Bridging native assets to non-native environments.
• Example: Wrapped BTC (WBTC) on Ethereum.

Bridges secured by a dedicated, permissioned set of validators who stake the bridge's native token to participate in verifying cross-chain transactions.

• Examples: Multichain (prior architecture), Polygon POS Bridge, Avalanche Bridge.
• Mechanism: Validators observe events on Chain A, reach consensus, and sign off on the validity for Chain B. Slashing mechanisms punish malicious actors.
• Consideration: Security depends on the economic security and honesty of the validator set, not the underlying chains.

Choosing a bridge involves evaluating core trade-offs between security, speed, cost, and generality.

• Trust Assumption Spectrum: From trustless (Light Client/ZK) to trusted (Staked Validators).
• Latency vs. Finality: Optimistic bridges have long challenge periods for security; ZK/Liquidity bridges are near-instant.
• Generalizability: Some bridges only transfer assets (asset-specific), while others transfer arbitrary data (general message).
• Cost: Verification cost varies significantly between proof systems and validator networks.

A custodial bridge (or trusted bridge) is a cross-chain bridge where user assets are held by a centralized third-party custodian or a multi-signature wallet during the transfer. This model introduces counterparty risk, as users must trust the custodian's security and solvency. While often faster and cheaper, it is considered less secure than non-custodial alternatives.

• Key Risk: Reliance on a trusted intermediary.
• Example: Many early centralized exchange bridges operated on this model.

A liquidity network (or liquidity-based bridge) is a type of non-custodial bridge that uses pooled liquidity on both chains to facilitate instant transfers. Users trade assets with a liquidity pool rather than locking and minting them. This model is common in Atomic Swap-inspired designs and relies on automated market makers (AMMs).

• Mechanism: Asset swap via liquidity pools.
• Trade-off: Requires sufficient liquidity to function efficiently.

An Atomic Swap is a peer-to-peer, non-custodial exchange of cryptocurrencies across different blockchains using Hash Time-Locked Contracts (HTLCs). It is the foundational primitive for trustless interoperability. The swap either completes entirely for both parties or fails entirely, eliminating counterparty risk. While conceptually pure, practical limitations (like scripting language compatibility) have led to its evolution into broader bridge architectures.

A wrapped asset (e.g., WETH, WBTC) is a token on a blockchain that represents a native asset from another chain. Non-custodial bridges create these tokens through a lock-and-mint or burn-and-mint process. The wrapped token's value is pegged 1:1 to the original asset, backed by the bridge's collateral or verifiable proofs. It is the primary output of many asset bridges, enabling the use of foreign assets in a chain's native DeFi ecosystem.