Connext

Connext and other joint initiatives have established open bridge standards, expressing concerns about LayerZero's deployment of multi-chain wstETH

ChainCatcher news, Layer2 interoperability protocol Connext tweeted, calling for the establishment of an open bridge standard along with Across, Celer Network, ChainSafe, Sygma, LI.FI, Socket, Router Protocol, and the Cross-chain Interoperability Alliance.The initiative expresses concern over LayerZero's recent actions, as they deployed wstETH to Avalanche, BNN Chain, and Scroll without the support of Lido DAO. It argues that:Proprietary standards locked by vendors are not standards. While OFT and other vendor-specific systems are marketed as standards, fundamentally, they are owned by the cross-chain bridges that implement them. They enforce vendor lock-in, making it nearly impossible for projects to iterate on preferences, respond to security risks, or otherwise switch to another option permanently.Lock-in creates systemic risk. Tokens issued through proprietary standards are forever tied to the security model of the issuing bridge. Lock-in hinders positive iterations on security, thereby introducing unquantifiable systemic risks to projects. Over the past two years, cross-chain bridges have suffered over $2 billion in hacks due to these systemic risks.Token issuers should own their tokens. Token issuing DAOs should be the ultimate arbiters of their assets' typical representations on specific chains. Without DAO-led social consensus, it becomes impossible to determine the typical representation of a specific asset, leading to fragmentation through the issuance of many non-reproducible representations.Open standards unrelated to providers encourage healthy competition. Open public standards like ElP-7281 (xERC20) allow token issuers to adopt typical representations as per point (3) while avoiding lock-in as per point (2), thereby rewriting the incentive structure around token bridge security. Standards drive bridges to compete openly and continuously on pricing, uptime, and security. This encourages ongoing innovation around secure bridging methods, ultimately benefiting users.

Slow Fog: The eligibility for the Connext airdrop is verified through a Merkle proof, and users who are not eligible cannot bypass the verification to claim someone else's airdrop

ChainCatcher message, according to SlowMist intelligence, some accounts' NEXT tokens have been claimed to unintended addresses. The SlowMist security team followed up with an analysis and shared a brief summary as follows:Users can claim NEXT tokens through the claimBySignature function of the NEXT Distributor contract. There are two roles involved: the recipient role, which is used to receive the claimed NEXT tokens, and the beneficiary role, which is the address eligible to receive NEXT tokens, determined when the Connext protocol announced the airdrop eligibility.When a user claims NEXT tokens, the contract performs two checks: first, it checks the signature of the beneficiary role; second, it checks whether the beneficiary role is eligible to receive the airdrop. During the first check, it verifies whether the recipient provided by the user is signed by the beneficiary role, so arbitrarily providing a recipient address without the beneficiary's signature cannot pass the check.If a beneficiary address is specified to construct a signature, it may pass the signature check, but it will not pass the second check for airdrop eligibility. The airdrop eligibility check is performed through a Merkle proof, which should be generated by the official Connext protocol. Therefore, users who are not eligible to receive the airdrop cannot bypass the check to claim someone else's airdrop.
ChainCatcher Building the Web3 world with innovators