Token Bridge Vaulting Strategy

[claudijd]

This discussion is aimed at trying to better elicit feedback on a possible strategy where token bridges with large TVL can carve a percent of their token TVL to a hardened smart contract with slightly higher levels of assurance.

Beneficial properties of this "vault" might include:

• Immutability (it would not be susceptible to upgrade risks)
• Rate-Limiting (if the token bridge were to be compromised, the vault would slow down the impact of such a compromise, buying time for incident response)
• Trust Boundaries (the vault could untrust the token bridge and likely untrust a bug in governance)
• Reduced Attack Surface (meaning the vault could have minimal functionality and configurability that could be abused)
• Simplicity (meaning the vault is very easy to audit and port to a variety of different runtimes without being beholden to capabilities and toolchains only available on one ecosystem)
• Per Chain (meaning you wouldn't need to do this for everything, it could be done for just a single token bridge without other token bridges needing to know anything about it)

Initial risks I can think of (but would like others to weigh in):

• Complexity - If the token bridge needs to work through immutable vaults, there could be some added complexity in migrating from one vault to the next if new capabilities are needed.
• Gas Cost - If the vault is a separate contract, it would also mean an increased gas cost for each token bridge transfer that would need to "top-up" the non-vaulted TVL to perform the transfer.
• Market Swings - If there a large market event (like the Merge) where holders of wrapped assets need to unwrap quickly, this could exhaust the rates that are set on the vault. It would require some calibration to assess the right balances, and user communication to be clear that when market events happen, the rate-limiting may take hold and slow the unwrapping process.
• Max Contract Size - In some run times, there are max contract size limits. It's unlikely this would be reached by the vault. Still, the associated token bridge that needs to know and use the vault may need to rearchitect and addition gas if the token bridge has functionality split across multiple contracts to work around max contract sizes.

[evan-gray]

Couple initial questions

• How would this vault contract be more hardened than the token bridge contract?
• What mechanism could be used to change rates or migrate the vault and how would the surface of those mechanisms differ from the existing governance of the token bridge?

[claudijd]

How would this vault contract be more hardened than the token bridge contract?

1. It would simply have fewer functions exposed (withdrawals + any config functions), so as a token bridge grows in complexity with various functions and new capabilities, the vault would largely stay somewhat simple and stagnant, ideally.
2. It could be immutable (thus not be subject to bugs that would result in a contract upgrade)
3. The vault could be backed by a completely different set of key material, which is not in any way directly subject to a guardiand compromise

What mechanism could be used to change rates or migrate the vault and how would the surface of those mechanisms differ from the existing governance of the token bridge?

1. If vaults were immutable, I think a possible mechanism for vault migration is maintaining something like an OLD_VAULT/NEW_VAULT parameters. In a stable singular vault scenario, these values would remain the same (likely the contract address for the vault). In a migration scenario, the OLD_VAULT value would stay the same, and NEW_VAULT would be set to the new vault contract address. New locking events would go to the token bridge, and any new excess would be purged into the NEW_VAULT. There could also be a permissionless crank that hangs off the token bridge that could be used to migrate specific assets off the OLD_VAULT and into the NEW_VAULT within the rate-limit thresholds. This most certainly requires more thought about the details, but that is my first stab at it. There is a lot of devil in the details on this one.
2. I think the governance of the configuration parameters on the vault would have the best security properties if it didn't trust normal Wormhole Governance. It's operationally more burdensome to ask Guardians to maintain a separate set of keys. Still, it has the property of insulating you from guardiand, governance, and token bridge smart contract compromises. I think it would be far less likely for a quorum of Guardians to misplace their "vault keys", which are presumably rarely used.

[evan-gray]

1. It would simply have fewer functions exposed (withdrawals + any config functions), so as a token bridge grows in complexity with various functions and new capabilities, the vault would largely stay somewhat simple and stagnant, ideally.

Notably this, in and of itself, would also cause the token bridge to have additional complexity subject to mistakes.

3. The vault could be backed by a completely different set of key material, which is not in any way directly subject to a guardiand compromise

If the goal is separating key material, we could simply separate the token bridge governance to separate keys instead of the guardian set directly.

2. I think the governance of the configuration parameters on the vault would have the best security properties if it didn't trust normal Wormhole Governance. It's operationally more burdensome to ask Guardians to maintain a separate set of keys. Still, it has the property of insulating you from guardiand, governance, and token bridge smart contract compromises. I think it would be far less likely for a quorum of Guardians to misplace their "vault keys", which are presumably rarely used.

Aren't the keys you never use precisely the ones you misplace? 😛

[evan-gray]

One more

• What tokens would be vaulted and at what limits and what does that look like in effect? For example, if it was decided to vault over $20M notional, there's only a two tokens with that amount which covers about a third of the TVL.

[claudijd]

What tokens would be vaulted and at what limits and what does that look like in effect? For example, if it was decided to vault over $20M notional, there's only a two tokens with that amount which covers about a third of the TVL.

My suggestion would be to focus on the most significant pockets of token TVL on the most prominent chain(s). I don't know if that would be something where it would make sense to vault anything over a threshold or make it more of a simple control that says, "if this token, then vaults after this threshold." The best I can tell, the most valuable targets are probably just ETH/USDC on Ethereum.

[evan-gray]

I agree that ETH and USDC on Eth seem like the lowest hanging fruit, so it's probably best to focus discussion on what it would look like there for now.