Brain dump on bridge security:

Bridges are nothing special, they are a form of decentralized custody. There are two main attacks:
1. Collusion
2. Intrusion (attackers hijack the private key)
And these attacks are implementation agnostic. It makes no difference
(cont)

how the bridge is implemented. If it's a multisig, IBC (also near's rainbow), network like tBTC. What this attack looks like for any network:
1. user deposits tokens into bridge
2. attackers spend the funds by signing a message to transfer tokens from the bridge
Simple! (cont)

In the case of IBC the message is a consensus header, in the case of tBTC it's a bitcoin transaction, in the case of a multisig it's a regular transfer. The approaches we have try to reduce the likelihood of the attack. (cont)

1. increase the number of signers (collusion is harder, intrusion is harder)
2. reduce the surface area (intrusion is harder)
3. punishment for the signers in case of attacks (collusion is harder)

(cont)

If you have ever played Coup it should be obvious that 3 only works if the signers cannot block it. Punishment for the M signers needs to be carried out on a network that M cannot censor. So if the 3 eth mining pools that have 51% of the hash power also ran tBTC (cont)

we would be in trouble :). The only other thing we can do for the users is to insure them on another network. To do so, we need 2 things:
1. Other network is not censorable by M signers as well (duh)
2. Proofs that the M signers signed an invalid header/message
(cont)

In case of BTC, the insurer network cannot be bitcoin itself. In case of ETH, the insurer network can be ethereum, but it should be obvious that the insurance pool is much less effective if it is the remote network with IBC. If M can censor the "insurance" network (cont)

they can censor the insurance payout requests. If 3 eth mining pools put in funds into the insurance pool for a bridge to solana, and they also ran the bridge, they can take the user's eth deposits and censor fraud proofs to the insurance pool.