⚠️ Warning⚠️
⚠️ This code is being actively developed and is not yet production ready.
⚠️ DO NOT deploy this code or use deployments of this code for anything valuable.
Hashi is an EVM Hash Oracle Aggregator, designed to facilitate a principled approach to cross-chain bridge security.
The primary insight being that the vast majority of bridge-related security incidents could have had minimal impact if the systems relying on them had built in some redundancy. In other words, it's much more secure to require messages be validated by multiple independent mechanisms, rather than by just one.
We call this setup a RAIHO (Redundant Array of Independent Hash Oracles).
Hashi (橋) allows users to:
- Build custom oracle adapter contracts for any hash oracle mechanism they would like to use.
- Query an oracle for the hash for a given ID in a given domain. (e.g. header of a block on a given chainId)
- Query a set of oracles the hash for a given ID in a given domain.
- Query for a unanimously agreed upon block hash from a set of oracles for a given ID in a given domain.
ShoyuBashi (所有橋) allows:
- An
owner
account to:- Define an instance of Hashi to query.
- Define a set of oracles for each domain.
- Define a threshold of oracles that must agree on a hash for each domain.
- Change any of the above settings at any time.
- Anyone to:
- Query for a unanimously agreed on hash from that full set of oracles.
- Query for a hash agreed upon by a threshold of oracles for a given block on a given chain; the provided oracles must all agree on the hash for the ID, must all be enabled as oracles for the given domain, and must exceed the threshold for the domain.
Yaho (ヤッホー) allows users to:
- dispatch arbitrary messages via Hashi, which:
- emits the hash of arbitrary messages as events
- stores the arbitrary message in storage
- relay previously stored messages to any number of message adapters
- dispatch messages and relay them to adapters in a single call
Yaru (やる) allows owner
to:
- execute arbitrary messages passed from Yaho
Hashi Zodiac Module allows users to:
- Control an avatar (like a Safe) on one chain from a
controller
address on another chain, via messages passed over hashi. - Define an instance of Yaho which can pass it messages.
- Define a
chainId
(usually calleddomain
elsewhere in this repo). - Define a foreign
controller
address.
Hashi's additional redundancy obviously comes with a higher gas cost, along with moving only as quickly as the slowest oracle in a given set. However, this trade-off seems well worth it given the scope and frequency of past bridge-related security incidents.
Hashi has been audited by the G0 group.
All issues and notes of the audit have been addressed as of commit hash 9f373635.
The audit results are available as a pdf in this repo.
Please note, there have been changes to contract code since this audit. A subsequent audit of the changed code is pending.
All contracts are WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Created under the LGPL-3.0+ license.