Wormhole Approved for Use in All Cross-Chain Deployments by Uniswap Bridge Assessment Committee

TL;DR

• The Uniswap Bridge Assessment Committee has approved Wormhole for all cross-chain deployments following an extensive evaluation of six different bridges.
• The assessment framework considered risk analysis across architecture, implementation, operation, and network.
• Wormhole demonstrated strong security measures, including robust tests for core components, published audits, and an active $2.5m bug bounty.
• The committee recommended future improvements in validator decentralization, latency issues, and in-protocol mechanisms for validator passivity.
• The Uniswap v3 deployment script recently improved by Wormhole Foundation and GFX is freely available to all EVM-based blockchains to quickly deploy Uniswap v3 and pass the governing rights to the Uniswap DAO (blog)

In a first-of-its-kind report, the Uniswap Bridge Assessment Committee, commissioned by the Uniswap Foundation, has assessed six different bridges and has approved Wormhole for use in all cross-chain deployments. The analysis concluded that Wormhole (currently Uniswap’s most used cross-chain protocol) satisfies the requirements of the Uniswap DAO's cross-chain governance use case as outlined in their assessment framework.

Background

In late 2022, the Uniswap forum received a proposal to officially deploy Uniswap v3 on BNB Chain, which generated a lot of discussion around which bridging solution to use for the cross-chain governance use-case. The proposal to deploy Uniswap v3 to BNB Chain passed, and Wormhole was selected as the bridge provider to enable the deployment. After the discussion, the Uniswap Foundation team commissioned a Cross-Chain Bridge Assessment Committee (composed of independent security experts) to evaluate bridging technologies. The committee came up with a framework for unbiased evaluation of bridging protocols, evaluated six major bridges using that framework, and today provided their recommendations for which bridges should be approved or not based on their assessment and framework

Methodology

Uniswap’s Cross-Chain Bridge Assessment Committee assessed the bridging protocols based on a wide range of factors including security, extensibility (ability to easily scale to new Uniswap deployments, flexibility (ability to evolve and upgrade over time), and integration effort.

Based on these high level areas of evaluation, the committee created a framework to evaluate each of the six bridges which included the following four categories of risk:

1. Architecture Risk
2. Implementation Risk
3. Operational Risk
4. Network Risks

The committee then used a two step process for completing their evaluation and recommendation. First, they assessed the core properties, design choices, and assumptions of each protocol, as well as completed a high-level review of its implementation and operational practices. Protocols that met relevant criteria during this phase proceeded to the second phase. In the second phase, a rigorous assessment was completed across all four categories of risk, including analysis of source code and both on-chain and off-chain data.

Key takeaways for Wormhole

Conclusion: Wormhole was approved for use in all cross-chain deployments by the committee. The committee also concluded that the internal design of the components appears to be well thought out and in accordance with best practices. Overall, the observations were indicative of a mature codebase.

Below is the extended conclusion:

The analysis of Wormhole concluded it satisfies the requirements of the Uniswap DAO's cross-chain governance use case as outlined in the assessment framework above. The set of validators includes many reputable entities, and both the number of validators and security thresholds are set at satisfactory levels.

Moreover, the implementation of the protocol and operational security practices are well considered, with significant improvements to their DevSecOps practices and incident response procedures since its exploit incident that occurred in February 2022.

The Committee has identified some areas of improvement and recommends periodical monitoring of any material changes that may affect the protocol’s security profile.

The committee also raised a few recommendations for Wormhole that the Wormhole contributors are taking into account for future development roadmap. These include the following areas:

• Recommendation: Further decentralize the validator set while maintaining a high bar for the quality of validators, building more in-protocol assurances and developing sound incentivization models for these validators.
• Recommendation: The Committee encourages the team to define clear metrics for assessing the quality of validators, perform ongoing due diligence on validators, and publish validator information to the community.
• Recommendation: The Committee encourages the team to investigate extant latency issues, have measures in place to ensure minimum level of validator performance, and also to publish detailed metrics (including historical data), about validator performance.
• Recommendation: The Committee encourages the team to consider implementing in-protocol mechanisms to address this [validator passivity] issue, drawing inspiration from other cross-chain protocols that have done so.

Wormhole Security

The committee’s security assessment concluded that Wormhole’s internal design is well thought out and in accordance with best practices. And overall, their observations were indicative of a mature codebase. They also made several other observations about Wormhole’s robust security practices, including:

• Audits from numerous well-known security firms on different aspects of the system, with varying levels of scope. All published audits indicate that any high or critical severity issues have been resolved.
• Robust tests for core components and overall system.
• Active bug bounty of up to US $2.5m (capped at 10% of the impacted value).
• Sufficiently detailed and informative technical documentation.
• A well-defined development and deployment practice.
  

In summary, the Uniswap Bridge Assessment Committee has officially approved Wormhole for use in all cross-chain deployments following their comprehensive assessment. The cross-chain protocol, currently the most utilized for Uniswap, meets the requirements of Uniswap DAO's cross-chain governance use case as delineated in the Committee's evaluation framework. This approval follows a thorough analysis of Wormhole's architecture, implementation, operation, and network risks. Notably, the assessment highlighted Wormhole's strong security measures, mature codebase, and extensibility. The Committee also issued several recommendations for further improvements, particularly focusing on validator decentralization, clear metrics for validator assessment, addressing latency issues, and implementing in-protocol mechanisms to tackle validator passivity. All in all, Wormhole Foundation looks forward to continuing to work to grow the Uniswap protocol and provide a best-in-class interoperability platform for builders.

About Wormhole

Wormhole is the industry standard cross-chain messaging protocol powering applications across Web3. Wormhole provides developers access to liquidity and users on over 20 of the leading blockchain networks, enabling use cases that span DeFi, NFTs, governance, and more. Wormhole enables a growing suite of products to build on its messaging layer. Wormhole Connect is a key asset layer product, providing developers an in-app bridging widget that can be integrated in as few as 3 lines of code. The wider Wormhole network is trusted and used by teams like Circle and Uniswap, and to date, the platform has facilitated the transfer of over 35 billion dollars through hundreds of millions of cross-chain messages.

To learn more about Wormhole, visit wormhole.com, chat with us on Discord, or find Wormhole Connect integration details at wormhole.com/connect