Cross-Chain Bridges: Blockchain Interoperability Guide

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

// Chain A: Deposit contract
contract WrappedTokenBridge {
    IERC20 public token;
    address public custodian;
    uint256 public totalLocked;
    
    event Deposited(address indexed user, uint256 amount);
    event Withdrawn(address indexed user, uint256 amount);
    
    constructor(address _token) {
        token = IERC20(_token);
        custodian = msg.sender;
    }
    
    function deposit(uint256 _amount) external {
        token.transferFrom(msg.sender, address(this), _amount);
        totalLocked += _amount;
        emit Deposited(msg.sender, _amount);
        
        // Off-chain: custodian mints wrapped tokens on destination chain
    }
    
    function withdraw(uint256 _amount) external {
        // Called when user returns wrapped tokens on destination chain
        require(_amount <= totalLocked, "Insufficient liquidity");
        token.transfer(msg.sender, _amount);
        totalLocked -= _amount;
        emit Withdrawn(msg.sender, _amount);
    }
}

// Chain B: Mintable wrapped token
contract WrappedToken is ERC20 {
    address public bridge;
    
    constructor(string memory name, string memory symbol) ERC20(name, symbol) {
        bridge = msg.sender;
    }
    
    function mint(address _to, uint256 _amount) external {
        require(msg.sender == bridge, "Only bridge");
        _mint(_to, _amount);
    }
    
    function burn(uint256 _amount) external {
        _burn(msg.sender, _amount);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

contract LiquidityBridge {
    mapping(address => uint256) public liquidity;
    
    event LiquidityAdded(address indexed provider, uint256 amount);
    event Swap(address indexed user, uint256 amountIn, uint256 amountOut);
    
    function addLiquidity() external payable {
        liquidity[msg.sender] += msg.value;
        emit LiquidityAdded(msg.sender, msg.value);
    }
    
    function swapToChain(uint256 _amount) external {
        require(_amount <= address(this).balance, "Insufficient liquidity");
        require(liquidity[msg.sender] == 0, "LP cannot swap");
        
        // Lock the sender's tokens on this chain
        IERC20(token).transferFrom(msg.sender, address(this), _amount);
        
        // Transfer ETH to sender (from LPs)
        payable(msg.sender).transfer(_amount);
        
        // On destination chain, the bridge unlocks equivalent tokens
        emit Swap(msg.sender, _amount, _amount);
    }
    
    function removeLiquidity(uint256 _amount) external {
        require(liquidity[msg.sender] >= _amount, "Insufficient");
        liquidity[msg.sender] -= _amount;
        payable(msg.sender).transfer(_amount);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

contract MerkleBridge {
    struct Transfer {
        address sender;
        address recipient;
        uint256 amount;
        uint256 sourceChainId;
        uint256 destinationChainId;
    }
    
    bytes32[] public roots;  // Merkle roots of transfer batches
    mapping(bytes32 => bool) public usedProofs;
    
    event TransferInitiated(address indexed sender, address indexed recipient, uint256 amount, uint256 destinationChainId);
    event TransferClaimed(bytes32 indexed transferHash);
    
    function initiateTransfer(address _recipient, uint256 _amount, uint256 _destinationChainId) external payable {
        require(_amount > 0, "Amount must be positive");
        
        // Lock ETH
        emit TransferInitiated(msg.sender, _recipient, _amount, _destinationChainId);
    }
    
    function claimTransfer(
        bytes32[] calldata _proof,
        bytes32 _transferHash,
        address _sender,
        address _recipient,
        uint256 _amount
    ) external {
        require(!usedProofs[_transferHash], "Already claimed");
        require(verifyProof(_proof, roots[roots.length - 1], _transferHash), "Invalid proof");
        
        usedProofs[_transferHash] = true;
        payable(_recipient).transfer(_amount);
        
        emit TransferClaimed(_transferHash);
    }
    
    function verifyProof(bytes32[] calldata _proof, bytes32 _root, bytes32 _leaf) internal pure returns (bool) {
        bytes32 computedHash = _leaf;
        
        for (uint256 i; i < _proof.length; i++) {
            bytes32 proofElement = _proof[i];
            
            if (computedHash < proofElement) {
                computedHash = keccak256(abi.encodePacked(computedHash, proofElement));
            } else {
                computedHash = keccak256(abi.encodePacked(proofElement, computedHash));
            }
        }
        
        return computedHash == _root;
    }
}

// Bridge risk assessment
const bridgeRisks = [
  {
    type: "Validator Collusion",
    description: "8-of-10 multisig validators collude to steal funds",
    example: "Ronin Bridge hack ($620M, 2022)",
    mitigation: "Use trustless bridges with economic security (bonded validators, slashing)",
    severity: "Critical]
  },
  {
    type: "Smart Contract Bug",
    description: "Vulnerability in bridge contract code allows draining",
    example: "Wormhole hack ($326M, 2022)",
    mitigation: "Multiple audits, formal verification, bug bounties, timelocks",
    severity: "Critical"
  },
  {
    type: "Liquidity Manipulation",
    description: "Attacker manipulates pool prices during bridge operation",
    example: "Nomad bridge exploit ($190M, 2022)",
    mitigation: "Price oracles, slippage limits, circuit breakers",
    severity: "High"
  },
  {
    type: "Reentrancy",
    description: "Cross-chain reentrancy attacks via message passing",
    example: "Poly Network hack ($611M, 2021)",
    mitigation: "Reentrancy guards, checks-effects-interactions",
    severity: "High"
  }
];

bridgeRisks.forEach(risk => {
  console.log(`${risk.severity}: ${risk.type}`);
  console.log(`  Mitigation: ${risk.mitigation}`);
});

// Expected output:
// Critical: Validator Collusion
//   Mitigation: Use trustless bridges with economic security...
// Critical: Smart Contract Bug
//   Mitigation: Multiple audits, formal verification...
// High: Liquidity Manipulation
//   Mitigation: Price oracles, slippage limits...
// High: Reentrancy
//   Mitigation: Reentrancy guards, checks-effects-interactions...