The Security Benefits of DLCs vs. Bridging or Wrapping

Bitcoin is the most valuable cryptocurrency by market cap, and enabling it to be controlled by smart contracts on Ethereum presents a Trillion dollar opportunity. However, these chains can't communicate directly. To date, the only way to connect these chains has been through wrapping, bridging or the use of centralized finance (CeFi). But these methods all introduce severe security risks that have led to tens of Billions of dollars in losses.

Discreet Log Contracts (DLCs), first proposed at MIT by Lightning Network co-creator Tadge Dryja, provide a safer way. Instead of pooling assets in one place, DLCs enable users to lock Bitcoin in decentralized escrow accounts in users' wallets. DLCs significantly reduce the possibility of hacks and custodial failures which have led to over $40 Billion in lost wealth in recent years.

Risks of Wrapping, Bridging and CeFi

Web3 was built on the concept of decentralization and was designed to avoid the use of centralized points of failure as much as possible. Failures at custodians present a major source of losses. However, decentralized finance (DeFi) itself suffers from smart contract vulnerabilities. According to Chainalysis' 2022 Crypto Crime report, faulty code at DeFi platforms led to code exploits and flash loan attacks. In this section, we will characterize the risks of bridging Bitcoin using both decentralized and centralized methods.

Loss of Control

The idea of relying on custodians is a highly contested topic in the cryptocurrency industry. As centralized parties, these custodians are subject to regulations and censorship. For example, using Wrapped Bitcoin (WBTC) on Ethereum requires storing Bitcoin at BitGo, thus giving up the anonymity and censorship resistance benefits of Bitcoin.

Crypto bridges like the Binance Bridge and RenVM do not impose KYC when minting tokens. But as RenVM's terms and conditions state, regulations may influence their processes or even delete assets. Even though it is governed by a decentralized organization, the bridge is entirely subject to regulation or governmental actions.

Custodial Failures

In July 2022, cryptocurrency lending protocol Voyager Digital filed for bankruptcy. The announcement came just days after hedge fund Three Arrows Capital (3AC), which owed Voyager $650 Million in loans, declared insolvency. As it turned out, Voyager took their users' funds and used them to make high-risk bets at 3AC, which then led to users' deposits being confiscated.

That same summer, $40 Billion was lost at Celsius in a similar way. In later interviews, Celsius employees painted an image of high risk-taking, inefficiency and suspected market manipulation. There are even reports that Celsius founder Alex Mashinsky personally cashed out $10 Million directly from user deposits a week before the company barred users from accessing their own accounts. The company's activities caused a gap of $1.2 Billion as listed in its bankruptcy filing.

Bridge Hacks

When DAOs manage the minting process in a decentralized manner, there are no intermediaries to mismanage the collateral. However, the security of user's deposits depend on the system's reliability. Like any DeFi applications that use smart contracts, DAOs themselves can malfunction. The $120 Million BadgerDAO hack, the $650 Million Ronin hack and the recent $600 Million Binance hack are all examples of this.

The attackers exploited security gaps in the BadgerDAO protocol's front-end. The hack began with a compromised API key for Badger's Cloudflare account, which let the hackers inject a malicious snippet into custom routes. The snippet was triggered when users tried to execute transactions on the platform. The code included additional unlimited spending approvals for the hackers' addresses. Once the approvals were in place, the attacker performed transactions that sent assets from user accounts to their accounts. The hackers broke into 500 wallets and stole $120 Million worth of cryptocurrency from their owners.

Enabling interoperability through Layer Two (L2) protocols also comes with its fair share of risks. Since L2 protocols are on other networks, they are only as secure as the leading networks they operate on and share in their vulnerabilities. For example, a network failure on an L1 could lead to users losing all assets locked on an L2 bridge. In addition, the bridge operators themselves can collude or mismanage user funds. 

The Security Benefits of Using DLCs

Discreet Log Contracts present a promising alternative. Unlike token minting methods that involve custodians, DLCs hold collateral across multiple escrow accounts without introducing a central point of failure. Let’s dive into the security benefits of DLCs.

Reduction of Online Attacks

DLCs are best thought of as multi-sig wallets where the payout depends on an impartial attestation layer. A DLC uses an attester's signature of a given message as a private key to allow signing of a transaction and by design only allow the assets in the contract to be spent.

The DLC security mechanism is straightforward as it involves only two keys. The first key (the "funding key") controls half of the multi-sig funding transaction. The other key (the "payout key") gets paid. Generally, the funding key is initially a hot key that can be made cold. Users need it to sign Contract Execution Transactions (CETs) and these keys have to be specified at the creation of the DLC.

By signing a CET, the funding key generates all the necessary signatures that could be required, so the user can keep it in cold storage throughout the contract period. On the other hand, the payout key can be cold forever since it is rarely used as it only receives funds. Using cold keys significantly minimizes exposure to online attacks, especially for very long-term contracts.

Non-Custodial Escrow Functionality

DLCs allow non-custodial escrow functionality, like loans, swaps, and bets, in a trust-minimized way. The other party in the DLC cannot steal the funds in any way, the funds are not held by a single custodian. Instead, Bitcoin is held directly in participants’ wallets and the parties retain control of their private keys. Remember: Not Your Keys, Not Your Bitcoin!

When bridging, participants use a blockchain like Ethereum to wrap funds and require the help of a third party to execute the contract. The third-party sources data from external sources, hence acting as an attester. However, this introduces the "attester problem" since that an attester can be corrupted or can collude with one of the participants.

In the case of DLCs, the attester is automated and, by design, does not know who the participants are. The participants encode the bet into one transaction that invokes the attester. When the automated attester receives the CETs, the DLC completes the payout. The CETs are the set of mathematically possible outcomes from the DLC. They can only be between the original participants of DLC, so the BTC output can't be directly stolen by a third party. Because the CETs are predefined, it gives great assurance to the participants that the outcome will only follow pre-determined paths.

Elimination of Central Points of Failure

DLCs split user collateral across thousands of individual escrow accounts, eliminating central points of failure. Being split across thousands of wallets means there is no single vulnerability that attackers can exploit or corrupt. Even if one account is hacked or doesn't work, the other accounts can still reach a consensus.

Since DLCs natively run on the Bitcoin blockchain, any assets minted on Bitcoin inherit its base-level security. Since its inception in 2009, the Bitcoin network has never experienced any security breaches, making it stand out as the most secure and reliable blockchain. It's also widely considered hack-proof as the entire network of nodes regularly reviews it.

The Advantage of Holding Collateral on the Bitcoin Blockchain

Bridges are a hot spot for hackers as they store assets at centralized points on the receiving network. Regardless of how user's deposits are stored – locked up in a smart contract or with a custodian – the storage point will always remain highly vulnerable to attacks.

Following the recent Nomad Bridge hack, Chainalysis estimates that $2 Billion in crypto has been exploited through 13 cross-chain bridge hacks. These attacks account for 69% of the crypto stolen in 2022. The figures represent a major threat to cultivating trust in cross-chain bridges.

Final Thoughts

We believe that the non-custodial escrow of Bitcoin via DLCs should be the go-to solution in the industry. We are building infrastructure that provides a secure and decentralized way for smart contracts to interact with the Bitcoin network without sending assets to another chain. DLC.link transactions only use genuine, private, native Bitcoin and do not rely on centralized entities for trust.