Analysis: Can Layer2 assets inherited from cross-chain bridges avoid risks?
TechFlow Selected TechFlow Selected
Analysis: Can Layer2 assets inherited from cross-chain bridges avoid risks?
If a bridge is hacked but I received my tokens on the destination chain, am I at risk?
Navigating Web3 tides with focused insightsAuthor: bartek.eth
Compiled by: TechFlow
One of the most common questions among DeFi users is: "If a bridge gets hacked and I’ve already received my tokens on the destination chain, am I still at risk?" Answering this question turns out to be surprisingly difficult, but it’s critically important to understand its essence.
I will walk through some examples to introduce three key architectural concepts—message bridges, token bridges, and liquidity networks. Let's start with the simplest case: you want to transfer $MKR to Optimism, so you use their “standard” bridge.
What happens behind the scenes is that your MKR tokens are locked in custody within the L1 token bridge, while an equivalent amount (hopefully) is minted on L2.
You can check the amount of MKR held in the ERC bridge contract and the amount of MKR minted on Optimism.
The amount of MKR on L2 is slightly less than the custodied amount—likely because some funds are “in transit” or being withdrawn. Still, seeing more tokens in custody than minted is reassuring.
If the L1 custodial contract is hacked, or if due to a bug more $MKR is minted on L1 than is backed in custody, your $MKR on L2 could become worthless. Therefore, as long as you hold $MKR on Optimism, you remain exposed to the risks of both the token bridge and the message bridge it relies on.
Why then do we distinguish between token bridges and message bridges? Because multiple different token bridges can share the same underlying message bridge—for example, $MKR, $SNX, and $DAI on Optimism.
Holding any of these assets exposes you to both the message-passing bridge risk and the individual token bridge risk (for instance, the risks associated with $DAI and $MKR differ).
What if you use a non-standard “bridge” (like HopProtocol) to move assets to Optimism? This is what I refer to as a liquidity network (even though it presents itself as a bridge in the user interface). What does that mean?
A liquidity network does not mint tokens on the destination chain. Instead, it pre-mints assets and uses them to swap with users. So for you, the outcome appears identical—but the underlying mechanism is fundamentally different.
Liquidity networks can run out of liquidity, meaning your deposit or withdrawal request might not be fulfilled. They also clearly introduce additional execution risks.
While your funds are “in transit,” you share the risks of the liquidity network. Once you receive your assets, you are only exposed to the standard “token bridge” risks associated with the asset you now hold.
Token bridge risks are relatively easy to verify. Therefore, when holding assets bridged via token bridges on L2, once your assets are settled, you no longer face risks tied to the liquidity network.
If you hold assets on L2 that were bridged using a liquidity network, how do you know which token bridge risk applies to you? Unfortunately, this isn’t easy to determine.
Moreover, some bridges are hybrids combining token bridges and liquidity networks, making it confusing for users to properly distinguish their functions. Take another example: using Multichain to transfer $DAI from Ethereum to Fantom.
When bridging $DAI to Fantom, you receive “mDAI,” which exposes you to both Multichain’s message bridge risk and its token bridge risk. However, Multichain is also a cross-chain liquidity network—complex and spanning dozens of blockchains and hundreds of tokens. In reality, your asset position looks like this:
You can observe that significantly more $DAI has been minted on Fantom than is backed by reserves in the ETH token bridge contract.
All of this sounds extremely complex and messy—and indeed it is. Yet user interfaces are designed to make the process appear seamless. Nevertheless, these risks should be understood and properly managed by asset holders. Ultimately, only when we can build message bridges that inherit security directly from Ethereum, atop which we deploy immutable and bug-free token bridges, will your L2 assets be as secure as those on Ethereum itself.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
