Around 4,000 BTC left a bridge on Sunday. No key was compromised. The signers signed a withdrawal that was correct by every rule they could check, because the sidechain software had created coins indistinguishable from everyone else's. Twenty-three minutes after those coins reached the peg-out service, the payment was on Bitcoin. Everything worked as designed. Three properties of that design decided the outcome, and none of them is about honesty. @pogun_io @omerh_

Between burn and payout there is a proof and a time window. The operator fronts the withdrawal from their own funds, so the user is not waiting. To be reimbursed, the operator posts a claim carrying a Groth16 proof that the burn of that specific NFT happened and that the fronted payment landed on Bitcoin. A false proof cannot be forged. A false claim can still be posted, but one honest verifier is enough to stop it.

The Mithril zero-knowledge light client verifies Cardano's own state inside a Cardano contract. It carries two costs: proving the certificate chain off-chain, and verifying that proof on-chain. Both are coming down.

The van Rossem hard fork adds CIP-133: that same multi-scalar multiplication as a native Plutus builtin. Moving it out of hand-written script and into the protocol will cut the dominant on-chain cost significantly.

A smart contract on #Cardano can now verify a proof of almost anything.

A proof of Cardano's Mithril certificate chain, verified on Cardano itself. Preprod, live, open. A Plutus contract checked a zero-knowledge proof that the certificate chain had reached a new checkpoint, and advanced its on-chain record of that chain. A chain of 103 certificates, proven by a 388-byte SNARK, verified in a single transaction. Transaction: preprod.cexplorer.io/tx/cd01… Full anatomy: gist.github.com/Sbcdn/ef020f…