Trust Models: Native, Light Client, Multisig, Optimistic

What you'll learn

• Why Trust Model Is the First Question
• Native Verification: Shared Security with the Destination
• Light Client Verification: IBC and Beyond
• External Validator Verification: Multisigs and MPC
• Optimistic Verification: Single-Honest-Watcher
• Hybrid Designs and the Trust-Cost Frontier

Key terms

Trust model

The specific assumption that must hold for a bridge to remain secure: who or what is authorized to attest to cross-chain events, and what stops them from lying.

Native verification

A trust model in which the destination chain itself verifies source-chain events, typically because the chains share a settlement relationship (e.g., rollup-to-settlement) or a validator set.

Light client verification

A trust model in which the destination chain runs a verifier for the source chain's consensus (e.g., IBC's Tendermint light client) and validates Merkle proofs of inclusion against accepted headers.

External validator verification

A trust model in which a separate set of attestors (multisig, MPC committee, or PoS validator set) signs off on cross-chain messages; common in Wormhole (19 Guardians), Axelar (75 validators), and Chainlink CCIP.

Optimistic verification

A trust model in which any party can submit a claim and any honest watcher can dispute it during a challenge window; relies on at least one honest watcher being attentive, as used by Across and original Nomad.

VAA (Verified Action Approval)

Wormhole's standardized message format containing a payload plus a quorum of Guardian signatures (13-of-19 threshold). Any destination chain can verify a VAA against the Guardian public keys.

DVN (Decentralized Verifier Network)

LayerZero V2's abstraction for the entities that attest to cross-chain messages. Applications can require any combination of DVNs (e.g., LayerZero Labs DVN, Google Cloud DVN, Polyhedra zkLightClient DVN, custom DVN).

Risk Management Network (RMN)

Chainlink CCIP's independent veto committee that can curse (block) suspicious cross-chain transmissions even after the primary DON has approved them. Layered defense beyond the primary committee.

Single-honest-watcher

The security assumption underlying optimistic bridges: as long as at least one watcher is honest and online during the challenge window, fraudulent claims will be reverted.

Challenge window

The time period during which optimistic-bridge claims can be disputed; typical values range from minutes (Across relayer repayments) to 7 days (Arbitrum/Optimism canonical withdrawals).