Chainlink has launched CCIP 2.0, enhancing security for blockchain transfers following a major hack earlier this year.
Chainlink has launched an upgraded version of its Cross-Chain Interoperability Protocol (CCIP 2.0), which allows businesses to implement customized security measures for blockchain transactions. This update comes in response to vulnerabilities highlighted by a significant hack earlier this year.
New Features to Reduce Security Risks
The CCIP 2.0 enables companies to integrate their own security checks into blockchain transfers, addressing the risks associated with single points of failure that have impacted other bridge technologies.
This upgrade follows a $292 million hack in April involving Kelp DAO, which was linked to a vulnerability in a LayerZero bridge that relied on a single verifier. In response, Kelp has moved its rsETH token to Chainlink for more robust security.
Previously, Chainlink's Risk Management Network provided an extra layer of protection, but it has now been integrated into the main verification process. Users who do not incorporate their own verifiers will now rely on a single verification network, which could heighten security concerns.
The CCIP allows for the transfer of both tokens and messages between different blockchains, a crucial function as direct blockchain communication is not possible. Bridges, which connect these blockchains, rely on verifiers to confirm transactions. If a verifier is compromised, it can lead to unauthorized withdrawals, as seen in the Kelp DAO incident.
Following the hack, which was allegedly carried out by North Korea's Lazarus Group, Kelp DAO criticized LayerZero for approving its single-verifier setup, prompting a broader discussion on security across similar applications using that technology. Almost half of the active LayerZero applications were found to utilize this risky configuration.
With CCIP 2.0, Chainlink offers a range of verifier options, allowing companies to utilize either their own systems or engage with external providers. Chainlink's network of 16 independent node operators will continue to verify transactions, regardless of whether additional security measures are implemented by users.
Chainlink aims to make the system accessible, with Chief Business Officer Johann Eid stating that users do not need to be experts in cross-chain security to effectively use the protocol. He noted the historical losses incurred by legacy bridges and the challenges of developing in-house solutions.
The update also modifies the previously independent Risk Management Network, indicating that optional verifiers can now perform checks, which may leave users without additional verifiers relying solely on the main verification network.
Current users of Chainlink have been automatically transitioned to CCIP 2.0, although the company has not yet disclosed which institutions are utilizing the new verifier options. However, it has confirmed that Aave and Maple are starting to implement features from the upgrade.
