Conversation

Replying to

Ex 3:

- Assumes that 1 honest party always exists - Can break if the honest parties are censored, or are not active - No need to trust any specific one, or multiple parties. 30 min latency Criticism:

Quote Tweet

Sergey Gorbunov

@sergey_nog

Mar 31, 2022

Replying to @arjunbhuptani

1) You can economically incentivize only so many watchers without blowing up transaction fees. 2) To attack, you just need to compromise the updater & DDoS the watchers for $5 a node, no need to *compromise* them. The cost of this is pretty low. Something else there?

Arjun | xcall me maybe

Replying to

and

Note that (A) nomad has the same property as L0 that risk is compartmentalized per-app-per-chain-pair rather than for whole network. Also note that the above criticism observes only the distributed systems properties of the system but fails to account for the cryptoeconomic...

Arjun | xcall me maybe

Replying to

and

...properties. (a) Odds 100 watchers with 90% liveness are all down at same time that fraud occurs? Infinitesimally small. (b) Updater slashed on fraud - what incentive is there to even attempt if success case is both highly unlikely and impossible to know # of watchers.

Arjun | xcall me maybe

Replying to

and

Fraud proof systems don't derive their safety from formal security, but from the economics that make fraud both highly visible and highly expensive. In a correctly designed fraud proof system, the "dispute path" will never even occur. This is same model as ORUs and channels.

Arjun | xcall me maybe

Replying to

and

Generally speaking, if you posit that ORUs and channels are secure (at this point, everyone does) And you posit that Nomad model itself is sound and maps to ORUs. Then logically Nomad is secure. (IMO criticisms should focus on second point and not first)

Replying to

and

makes sense. how do you solve verifier's dilemma for Nomad?

Replying to

and

another qq: if we achieve cheap & fast zk based msg passing -> will any of the above approaches remain relevant then? It can be an oracle in L0, but not sure why we'd bear extra cost for relayer & verifying in this case? ik its far away, but v curious about your pov on this

Arjun | xcall me maybe

Replying to

and

A valid ZKP of state transition in VM =/= valid bridge update. You need to verify consensus directly instead. This means zk would only be optimization on header relays. Additional drawbacks: - Different crypto primitives on each chain - Some consensus models unverifiable in zk