Hey Everyone, Raoul from Chainlink Labs here to share our technical and ecosystem proposal for a bridging and messaging partnership with GMX. Over the past 18 months the collaboration between the GMX and Chainlink communities has driven massive shared success, and weâre excited to pitch the opportunity to grow this success even wider!
Proposal: GMX <> Chainlink <> Across cross-chain partnership
This proposal aims to establish the Chainlink Cross-Chain Interoperability Protocol (CCIP) as the cross-chain bridging and messaging solution for GMX, in collaboration with Across as the intents-based protocol for fast and low-cost token transfers.
As a key long-time partner, Chainlink has supported the growth of GMXâs trading protocol by providing high-quality, decentralized, and sub-second market data through Chainlink Data Streamsâa pull-based oracle network solution. Chainlink currently helps enable highly reliable markets for GMX by securing more than $450M in TVL and $135M in open interest. Integrating CCIP would deepen the alignment between the GMX and Chainlink ecosystems, with GMX benefitting from the fact that adopting CCIP would introduce little-to-no additional trust assumptions or vendor risk given GMXâs ongoing usage of Chainlink Data Streams. There is also a strong alignment between Chainlink and GMX to drive GMX adoption, given our existing relationship, and this proposal to enable GMX to expand to multiple chains is part of a wider collaboration to grow DeFi adoption and usage with GMX.
As part of this proposal, we are collaborating with Across Protocol to combine their experience with intents-based bridging and Chainlinkâs battle-tested history of deterministic messaging to create a custom intents-based protocol specifically for GMX, to be built on top of CCIP and leverage its existing benefits. We believe that this solution offers the most robust and performant cross-chain bridging and messaging infrastructure for meeting GMXâs stated requirements.
Chainlink CCIP features the highest level of cross-chain security thanks to its time-tested oracle infrastructure, multiple layers of decentralization, independent Risk Management Network, Token Developer Attestation feature, high-quality node operators, highly audited codebase, and additional security features such as rate limiting and timelocked upgrades. By incorporating a custom, intents-based protocol on top of CCIP, GMX would benefit from CCIPâs best-in-class security and reliability, as well as the enhanced speed and cost-efficiency of intents-based bridging. This unmatched combination of security and speed helps ensure the continued success of GMX as a core pillar of DeFi.
With the CCIP-based intents solution, GMX users will be able to:
- Quickly transfer user funds cross-chain to the GMX Multichain Vault using an intent engine and solvers.
- Securely bridge GMX, GM, and GLV tokens across chains using CCIP, unlocking DeFi and other markets for native GMX assets.
The remainder of this proposal describes how the CCIP-based intents solution meets the current and potential future needs of GMX according to the proposalâs selection criteria.
1. Company Overview
Chainlink is the standard for onchain finance, verifiable data, and cross-chain interoperability. Chainlink launched on mainnet more than a half-decade ago, starting with decentralized data feeds. Since then, Chainlink has become the most widely adopted oracle solution and expanded to a decentralized computing platform featuring a variety of different data, compute, and interoperability services built upon the same battle-tested technological foundation. The Chainlink platform has successfully secured over $75 billion in DeFi TVL at its peak and enabled more than $20 trillion in transactional value since the start of 2022 across 47 blockchain networks.
Supported by Chainlinkâs unparalleled levels of security, reliability, and decentralization, CCIP is the interoperability standard for transferring tokens and/or data between any public or private blockchain network. CCIP currently supports 40+ blockchain networks in production, regularly adding additional chains. Notably, CCIP has been adopted as the canonical cross-chain infrastructure for more than 20 blockchain ecosystems, including Sonyâs Soneium, Ronin, Botanix, Celo, B² Network, BOB, and many others.
In all, more than 120 DeFi and other protocols have adopted CCIP for cross-chain token and/or data transfers. Chainlinkâs deep roots in DeFi are reflected in protocols adopting both its data solutions and CCIP, minimizing trust assumptions by using battle-tested Chainlink DONs. These protocols include:
- Aave, the leading DeFi lending market with $18B TVL, uses Chainlink Price Feeds and integrated CCIP to support its multi-chain expansion by enabling cross-chain governance and native cross-chain transfers of their GHO stablecoin.
- Lido, with $19B TVL, launched Direct Staking, a CCIP-powered cross-chain staking solution that enables users to stake their ETH and receive wstETH directly on L2 networks.
- Solv, with $2B TVL, integrated CCIP, Proof of Reserve (PoR), and Price Feeds for its SolvBTC ecosystem, enabling cross-chain transfers of their LSTs such as SOLVBTC, SOLVBTC.BNN, SOLVBTC.ENA, and others.
- Lombard, with $1.7B+ TVL, adopted CCIP, PoR, and Price Feeds for its LBTC token.
- Usual, with $800M TVL, adopted CCIP, PoR, and Price Feeds for its Usual ecosystem tokens.
- Magpie uses CCIP to secure its $700M ecosystem, including its Eigenpie, Babpie, Cakepie and Radpie ecosystems.
- Liquid Collective, with $210M+ TVL, adopted CCIP for bridging its LsETH liquid staking token to Base.
CCIP is also central to Chainlinkâs work with the worldâs largest banking and capital markets institutions to enable interoperability between private and public blockchains, as well as allowing tokenized assets to be interacted with through existing legacy infrastructure. Some highlights include:
- Swift, the interbank messaging network used by 11,500+ banks globally, collaborated with Chainlink and 12+ of the worldâs largest financial institutions and market infrastructures to successfully demonstrate how Swift member banks can use Chainlink CCIP to transfer tokenized assets across any public/private blockchain. Participants included the DTCC, Euroclear, Clearstream, ANZ Bank, Citi, BNY Mellon, BNP Paribas, Lloyds Banking Group, and SIX Digital Exchange (SDX).
- DTCC, the worldâs largest securities settlement system that processes $3+ quadrillion annually, collaborated with Chainlink and 10 of the worldâs largest financial institutions to successfully demonstrate how Chainlink CCIP can make mutual fund NAV data available across any public/private blockchain. Participants included Euroclear, Swift, UBS, Franklin Templeton, Wellington Management, CACEIS, Vontobel, and Sygnum Bank.
- ANZ Bank, one the worldâs largest banks with $1+ trillion in total assets under management, collaborated with Chainlink to successfully demonstrate how Chainlink CCIP can power the cross-border, cross-chain, and cross-currency settlement of tokenized assets.
- UBS Asset Management, the asset management arm of one of the worldâs largest banks with $5+ trillion in total assets under management, and SBI Digital Markets, a subsidiary of Japanâs largest online financial services group SBI Holdings, collaborated with Chainlink to streamline tokenized fund operations by automating fund subscriptions and redemptions with blockchains and smart contracts.
CCIP launched on mainnet in early access in July 2023 and entered general availability in April 2024âfollowing years of rigorous research and development. Since then, CCIP has enabled over $2B in cross-chain token transfers and actively powers $33.6B in Cross-Chain Tokens (CCTs). Unlike other solutions, CCIP usage has grown organically without any artificially-inflated incentivized usage metrics, and more chains, tokens, and dApps are increasingly adopting the protocol.
Across is a leading crosschain Intent-based bridging protocol. Intents enable a fast and cost-effective way for users to transfer value across chains and empower developers to build native seamless crosschain experiences into their dApps. Since going live in 2021, Across has processed over $19B. Its deep liquidity, rapid transfer speeds, and decentralized relayer network helps ensure reliability and efficiency, making it attractive for crosschain transfers. Acrossâs industry-leading speed is unmatched.
Across has also forged key partnerships:
- Uniswap: Across is integrated directly into Uniswapâs dApp and wallet, allowing users to execute crosschain swaps in a single click. This integration has resulted in over 600M in total volume, giving users a frictionless experience, with zero support tickets recorded since going live in October 2024.
- Optimism: Across is Optimismâs official L2 â L2 bridge and is featured as the default interoperability solution in both the Optimism and Base portals. This partnership ensures seamless and low-cost crosschain transfers across the OP Superchain.
- Arbitrum: Across supports Fast Withdrawals on Arbitrum Orbit chains, leveraging withdrawal times from 7 days to approximately 15 minutes for adopting chains. Integrating Across with Arbitrum Fast Withdrawals creates a symbiotic relationship that enhances capital efficiency and responsiveness in the Orbit ecosystem. Recently, Arbitrum unveiled its ambitious interop roadmap focused on intent-based solutions, in which Across and ERC-7683 are poised to become key enablers.
Beyond bridging, Across plays a key role in shaping the future of crosschain interoperability through its contributions to ERC-7683âan emerging standard for crosschain Intents. Co-created by Across and Uniswap, ERC-7683 offers flexibility in Intent creation and settlement, ensuring projects can adopt the standard while tailoring execution to their needs. While Across is the first crosschain Intents protocol in production today, ERC-7683 is now supported by more than 50 major projects including Arbitrum, Base, Optimism, Offchain Labs, Polygon and ZKsync, among others, additionally the standard has been endorsed by Vitalik.
Since its inception, Across has expanded to support a broad range of blockchain networks, providing seamless connectivity and accessibility for users and developers. Currently, Across supports 19 blockchain networks. With its robust infrastructure, Across is able to rapidly onboard new chains, including stack chains like OP, Orbit, and ZK Stack. Additionally, Across has completed a significant migration to support non-EVM chains.
Acrossâs decentralized design helps ensure long-term security and reliability. Acrossâs architecture is built on competitive relayers, creating a naturally decentralized network that provides optimal transaction speed and cost. This helps ensure that Across maintains its fee efficiency across all routes, providing users with a consistent, seamless experience. It is due to this intents-based design that Across can deliver its users a fast bridging experience.
Acrossâs crosschain intent solution makes the multichain landscape feel like one unified network. By abstracting away the complexities, Across enables users to have seamless crosschain experiences.
2. Technical outline
GMX Use Cases
The intents-based solution described in this proposal will be purpose-built for the use cases most relevant to GMX, with the overarching objective to enable a ânative-likeâ feel for GMX users, but is also flexible enough to evolve with GMXâs needs over time.
The solution is designed to support both the protocol and users across two key use cases:
Use Case 1: Fast Deposits and Withdrawal
The solution is designed to enable users to make deposits from and withdrawals to remote chains with minimal friction via intents to support trading on Arbitrum. In alignment with GMXâs requirements, our solution will support cross-chain transfers of multiple tokens at once.
Use Case 2: Bridging for GMX Native Assets
The solution is also designed to enable cross-chain transfers of GMX, GLV tokens, and other GMX native assets via the Cross-Chain Token (CCT) standard, which will support new use cases for these native assets in the multi-chain DeFi ecosystem.
To enable each of the aforementioned use cases, the proposed solution starts with the deployment of a Router contract, designed with modularity in mind to facilitate support for future upgradability and the avoidance of vendor lock-in. The Router provides a single address/interface for cross-chain requests, including fee estimation. A routing table defines which method (contract) to use for bridging.
At first the routes will include:
- Across intents for major assets and blockchains supported by Across.
- Native cross-chain token transfers for GMX issued assets via CCIP and the Cross-Chain Token (CCT) standard.
- A simple, custom Chainlink-built intent engine to allow for intent filling for assets and blockchains not yet supported by Across.
The below routing diagram is a high-level diagram to explain the modularity-focused approach that informs the rest of the design.
Cross-Chain Intent Architecture
To meet the unique requirements set forth by the GMX community, Chainlink and Across will work together to extend the ERC-7683 framework so it can be used to support a wider set of assets, and executed securely via CCIP. Across will support CCIP as one of its ERC-7683 compatible settlement systems. All GMX transactions will be secured using CCIP in order to maintain the same security and trust assumptions already inherent in the rest of the GMX system.
Additional development is required to enable full integration of solvers affiliated with CCIP token developers. In order to facilitate the best user experience and optionality, the solution will include a Router which enables usage of a proprietary intent system to cover a wider array of assets, including stablecoins, BTC and ETH LSTs/LRTs, and others.
This solution will solve the key challenges of intents-based bridging: maintaining the highest level of security and redundancy while providing users the best possible experience of fast, low-cost bridging across a wide range of assets. This is achieved by leveraging Acrossâ intent framework, while maintaining the use of Chainlink infrastructure for securing cross-chain messaging.
The solution is custom-designed to enable GMX users on remote chains to interact with the GMX Protocol deployed on Arbitrum with minimal friction and the highest level security, achieving this by incorporating solvers to execute user intents. Deposits will flow through a Router that can select between intent systems based on asset availability. Orders will then be forwarded either to Across intent system or to a custom Intent Engine being built for GMX to handle assets currently not supported by Across.
With this intents-based solution, users will submit their transactions on a source chain, which will transfer funds to an intent engine. Solvers then execute the userâs transaction on the destination chain, triggering the Engine on the destination chain to use CCIP to send a message that will release funds to the solver back on the source chain. This results in the solver being repaid in the tokens they used to execute the userâs transaction. The entire flow is designed to minimize both the transaction time and gas fees for users in the context of Chainlinkâs security-first standards.
The solution will have a range of features designed to meet GMXâs requirements, including defense-in-depth security, bundled token transfers and bridging, and ease of deployment. It is planned to also enable incorporation of multiple intent systems in order to quickly be able to adapt to new asset or chain requirements.
As part of the solution, a user will deposit funds on the remote chain and, depending on the asset, the best route will be chosen. Chainlink is collaborating with Across and enabling fulfilment via Across framework as well as the custom built intent solver system in order to support a wide range of assets. This solution is designed to interact with GMXâs planned multi-chain vault by enabling permit flows on the userâs desired remote chain that are ERC-2771 compliant.
The general user flow would work as follows:
- The user deposits funds on a remote chain.
- The funds arrive in the GMX vault on Arbitrum within seconds.
- The user trades via GMX with their vault balance.
- The user triggers withdrawal from the remote chain via GMX using ERC-2771.
- The funds leave the vault on Arbitrum and transfer to the userâs wallet on the remote chain.
Deposit Flow:
- User initiates a deposit sending funds on a remote chain (e.g., Base). User does not need gas on Arbitrum.
- Router determines intent network based on chain and token.
- Solver deposits assets for the user into the GMX MultichainVault
- Solver uses CCIP to issue a message on the remote chain to verify that the intended action took place on Arbitrum, which causes the release of assets from the UserChainIntentEngine on the remote chain to the solver.
Withdrawal Flow
- GMX initiates withdrawal requests for user specifying destination address and chain.
- Router determines intent network based on chain and token.
- Solver repays the user on the destination.
- Solver uses CCIP to trigger a smart contract to receive repayment on Arbitrum. CCIP issues a message on Arbitrum to verify that the intended action took place on the remote chain, which causes the vault to release the assets to the solver.
Exception Flow (for custom intent engine route):
On either side, the user will be able to trigger an abort by interacting directly with the intent engine on the source chain. CCIP is used to maintain deterministic state transitions between the 2 contracts. This allows the user to signal the desire to abort a bridge transaction, and the cross-chain system to determine if it is safe to pay them back, or if the request has already been filled.
Exception Flow (for Across route):
There are two fallbacks: an expiration or a slow fill. A slow fill means that the Across system fills the user without requiring a relayer to provide the capital. Itâs called a slow fill because it requires Across to optimistically verify this fill before executing it, which means the fill happens a few hours after initiation (much longer than a typical fill).
A slow fill happens when the following conditions are met:
- The input token and output token are the same asset.
- requestV3SlowFill is called on the destination chain before the expiration time for the intent.
- The slow fill is executed before any relayer fills it or the intent expires.
In cases where a slow fill canât or does not happen and a relayer does not fill the intent, the intent expires. Like a slow fill, this expiry must be optimistically verified, which takes a few hours. Once this verification is done, the user is then refunded their money on the origin chains.
The Across fill process is designed so that funds are returned to the user on one chain or another in a couple of hours (less than 8 hours). No user intervention is required.
Cross-Chain Settlement of GMX Assets Via CCIP
Enabling the cross-chain transfer of GMX assets (GMX, GLV, etc) requires a secure messaging protocol to enable the burning and minting (or locking and minting) of assets between chains. Intents alone cannot be used, as Intents-based bridging relies upon tokens already being integrated with a messaging protocol to enable the final settlement of assets. Given the security-sensitive nature of expanding tokens to additional blockchains, only a highly secure messaging protocol can be used.
Given GMXâs existing usage of Chainlink Data Streams and this proposalsâ intents-based CCIP-powered solution, enabling the native transfer of a GMX asset cross-chain would be best suited by Chainlink CCIP. The CCIP v1.5 upgrade recently introduced the Cross-Chain Token (CCT) standard, which enables token developers to integrate new and existing tokens with CCIP in a self-serve manner in minutes. CCTs are cross-chain native tokens secured by CCIP, supporting self-serve deployments, full control and ownership for developers, enhanced programmability, and zero-slippage transfers.
CCTs are token logic agnostic, meaning token developers can deploy pre-audited token pool contracts to turn any ERC20-compatible token into a CCT or deploy their own custom token pool contracts for bespoke token use cases. CCTs do not require token developers to inherit any CCIP-specific code within their tokenâs smart contract.
With the CCIP Token Manager, developers can manage ownership of their token contracts, CCIP token pools, lane expansion, and customized implementation logic, including rate limits across chains. The autonomy of CCTs eliminates the need for vendor lock-in, hard-coded logic, or external dependencies, allowing developers to customize functionality without compromising security.
CCIP supports multiple methods of transferring tokens cross-chain in a capital efficient manner including the following which can support GMX, GLV tokens and other GMX native assets:
- Burn and mintâTokens are burned on a source chain, and an equivalent amount are minted on a destination chain. This enables the creation of cross-chain native tokens with a dynamic, unified supply across chains.
- Lock and mintâTokens are locked on the chain they were natively minted on, and an equivalent amount of tokens are minted on a destination chain. These minted tokens can be transferred across other non-native destination chains via burn-and-mint or be burned to unlock tokens back on the original minting source chain.
We are happy to support the GMX community in pursuing whichever path it chooses in terms of a front end for its users to initiate cross-chain transfers. CCIP already powers a growing number of bridging front ends, including Interport Finance, OpenOcean, Transporter, and XSwap. CCIP v1.5 also introduced the CCIP SDK, which makes it even easier for protocols and application developers to build custom front-ends powered by CCIP, which can be housed directly on the GMX front end.
3. Bridging Cost & Speed
Intents-Based Bridging
In the vast majority of situations, a userâs funds will arrive in the GMX vault on the destination chain after one block confirmation on the source/remote chain. The speed of a userâs transfer will be case-by-case based on the source chain. For example, during high congestion on the Ethereum L1, the solvers may wait for 3 blocks instead of the standard one block confirmation to avoid block reorg risks. This is the same for all of the value categories mentioned in the tender.
For example:
-
Base > Arbitrum
-
- Current blocktime: 2 seconds (Expected upgrade in Q2 2025 to reduce blocktime to 0.2 seconds)
-
- Estimated e2e latency: 3 seconds
-
Sonic > Arbitrum
-
- Current blocktime: 0.5-1 seconds
-
- Estimated e2e latency: 2 seconds
-
Ethereum > Arbitrum
-
- Current blocktime: 12 seconds
-
- Estimated e2e latency: 13 seconds
-
BNB Chain > Arbitrum
-
- Current blocktime: 3 seconds
-
- Estimated e2e latency: 4 seconds
The proposed solution supports the following assets, enabling a wide range of collateral for GMX users:
Issuer |
Token |
Category |
Circle |
USDC |
Stablecoin |
Tether |
USDT |
Stablecoin |
Aave |
GHO |
Stablecoin |
Usual |
USD0 |
Yield-bearing stablecoin |
Usual |
USD0++ |
Yield-bearing stablecoin |
BitGo |
wBTC |
Wrapped BTC |
Solv |
SolvBTC |
Wrapped BTC |
Solv |
SolvBTC.BBN |
Yield-bearing BTC |
Lombard |
LBTC |
Yield-bearing BTC |
Ethereum |
wETH |
Wrapped ETH |
Lido |
wstETH |
Liquid Staking ETH |
The cost for the transfer of each of these assets via Intents are as follows:
Deposits
- USDT/wBTC: (i) 2-3bps charged by the solvers, including Across; (ii) gas cost on source chain
- All other assets: (i) 1-2bps charged by the solvers, including Across; (ii) gas cost on source chain
- $0.05 flat fee on all transactions, as requested by the solvers to be financially viable when solving small transactions (below $100).
Withdrawals
- USDT/wBTC: (i) 2-3 bps charged by the solvers, including Across; (ii) gas cost on source chain
- All other assets: (i) 1-2bps charged by the solvers, including Across; (ii) gas cost on source chain
- Note: For withdrawals to Ethereum, there will be a separate destination gas fee of ~$0.60 (under a 1 gwei gas environment). This is subject to changes in the gas environment.
These fees will be paid for by the user in the same token being transferred. More details are provided in the â5. Commercial Approachâ section below to lower the cost for the end users.
CCT Transfers
When transferring CCTs cross-chain, users pay a single fee on the source chain that covers the estimated gas costs of executing transactions via CCIP on the destination chain along with an additional flat fee. The flat fee rate varies based on the token pool mechanism used and the chain lanes used, ranging between $0.225 - $0.25 for non-Ethereum lanes. Fees can be paid in blockchain gas tokens, or in LINK for a discount. The flat fee is the same rate regardless of the amount transferred. There are no set-up fees or ongoing fees when integrating CCT.
More information on CCIP billing and fee payments can be found in the CCIP Billing Documentation.
4. Innovation & Unique Features
The solution will introduce a unique design that combines faster-than-finality solver-driven transactions with the industry-leading security of CCIP. In addition to incorporating a highly secure cross-chain protocol (CCIP) as a fallback to the IntentEngine, it will also benefit from the ongoing investments in research and development around CCIP that have led to a growing list of innovations including the Risk Management Network, Programmable Transfers, configurable rate limits, token developer attestations, and now intents-based bridging.
5. Commercial Approach
To further reduce the cost for the end users, we will be committed to the following initiatives:
Waiver of development cost
Development cost of the custom solution will be covered by Chainlink Labs, as part of the growing alignment in driving GMX adoption under the ongoing fee sharing agreement related to the use of Chainlink Data Streams.
Agreements with partners to lower cost or provide subsidy
There are expected to be agreements established with selected asset issuers to provide liquidity of their assets to solvers, helping ensure a cost-competitive solution for GMX users.
Active monitoring of solver networkâs cost competitiveness
There will also be periodic reviews on the cost competitiveness of the solver network. Given a proven history of substantial volume and efficient markets, the solver network will naturally grow and it should be possible to reduce the user cost over time to fast fill GMX bridge requests.
6. Timeline
The proposed solution is designed to support all requested chains while enabling seamless expansion to new chains with minimal integration work. While each chain expansion will have its own requirements, the core technical needs remain consistent:
- Deployment of Router & Intent Engine â A Router and Intent Engine to support a wider range of assets will be deployed on both the source and destination chains to coordinate solvers.
- Solver Compatibility â Solvers are required to operate on new chains. If additional solvers are required, we will collaborate with GMX to expand solver availability.
- CCIP Availability â CCIP is now live on 40 chains, with ongoing expansions. CCIPâs Solana integration is in development and expected in the coming months. For additional chains such as TON, we will work with GMX to prioritize as needed.
To ensure a smooth transition, we recommend the following phased approach as the implementation plan:
Phase 1: Initial Deployment (2-3 Months)
- Deliver a custom CCIP-based intents solution to GMX.
- Finalize integration with the solver network to facilitate cross-chain execution.
- Route selected assets via the Across Framework once secured by CCIP.
Phase 2: Expansion & Optimization
-
Continuous Chain Expansion â Work with GMX to prioritize and integrate additional chains as needed.
-
Infrastructure Enhancements â Expand solver network capabilities, supporting both permissioned and permissionless solvers for assets which are not supported by Across.
-
Further Decentralization & Flexibility â Implement mechanisms to enhance solution decentralization.
We look forward to collaborating with GMX on these phases and will share additional details as development progresses.
7. CCIP Architectural Design
Chainlink CCIP serves as the foundation of the solution proposed to be used by GMX. CCIP is underpinned by Chainlinkâs proven Decentralized Oracle Network (DON) architecture where multiple oracle nodes come to distributed consensus. DONs in the Chainlink ecosystem are operated by a geographically distributed collection of Sybil-resistant, security-reviewed node operators with significant experience running mission-critical infrastructure across Web2 and Web3.
Rather than operating as a single monolithic network, which can lead to speed and reliability issues due to constrained throughput, CCIP is composed of multiple DONs per chain laneâwith each lane consisting of a unique path between a source chain and destination chain. This approach allows CCIP to scale horizontally, as additional DONs are added to CCIP for each additional blockchain network supported as opposed to funneling all cross-chain traffic through a single network.
Each CCIP chain lane consists of three unique oracle networksâthe Committing DON, the Executing DON, and the Risk Management Network. The Committing DON is a decentralized network of oracle nodes that monitor events on a given source chain, wait for source chain finality, bundle transactions to create a Merkle root, come to consensus on that Merkle root, and commit that Merkle root to the destination chain. The Executing DON is a decentralized network of oracle nodes that submit Merkle proofs on a destination chain, which are then verified onchain by ensuring that the transactions were included in a previously committed Merkle root, which was also validated (aka âblessedâ) by the Risk Management Network.
The Committing DONs and Executing DONs in CCIP are composed of 16 high-quality independent node operators, while the Risk Management Network is composed of 7 distinct node operators (resulting in a total of 23 node operators). More information about the architecture and security model of CCIP can be found in the Chainlink documentation. Our real-time, public-facing dashboard for CCIP can be accessed at CCIP Explorer | Chainlink.
Risk Management Network
The Risk Management Network is a separate, independent network that continuously monitors and validates the behavior of CCIP, providing an additional layer of security by independently verifying cross-chain operations for anomalous activity. The Risk Management Network utilizes a separate, minimal implementation of the Chainlink node software, creating a form of client diversity for increased robustness while also minimizing external dependencies to prevent supply chain attacks.
The Risk Management Network was written in a different programming language than the primary CCIP system, developed by a different internal team, and uses a distinct non-overlapping set of node operators compared to the CCIP DONs. The Risk Management Network is a wholly unique concept in cross-chain interoperability that builds upon established engineering principles (N-version programming).
To increase the security and robustness of CCIP, the Risk Management Network engages in two types of activities:
-
Secondary Approval: The Risk Management Network independently recreates Merkle roots based on transactions from the source chain, which are then published on the destination chain and compared against the Merkle roots published by the Committing DON. Cross-chain transactions can only be executed if the Merkle roots from the two networks match.
-
Anomaly Detection: The Risk Management Network monitors for abnormal behavior from the CCIP network (e.g., committed transactions with no source chain equivalent) as well as the behavior of chains (e.g., deep block reorgs). If anomalous activity is detected, the Risk Management Network can trigger an emergency halt to pause all CCIP lanes and limit any losses.
Security Audits and Source Code
Security is the number one priority for the Chainlink ecosystem, a value we do not and will not compromise on. Chainlink Labs has put an immense amount of resources into developing the security model of CCIP, and as such, is the most audited Chainlink solution to date.
The onchain and offchain code for CCIP and the Risk Management Network underwent a total of 28 independent audits by five leading security firmsâCure53, Dedaub, NCC Cryptography Services, Sigma Prime, and Trail of Bitsâin preparation for the initial mainnet launch and subsequent deployments. Copies of all completed independent audit reports can be provided separately for review.
Additionally, four crowdsourced audits of CCIP and the Risk Management Network have been conducted on the Code4rena and CodeHawks platforms:
All valid findings were remediated and fixes confirmed with the respective auditors. In some cases, findings represented expected behaviors and were reviewed with auditors upon receipt of audit reports.
The onchain source code for CCIP is publicly viewable on GitHub:
Finally, CCIP is covered by the Chainlink bug bounty program on Immunefi, with a $3 million maximum bounty for critical smart contract vulnerabilities.
Security and Reliability
In keeping with Chainlinkâs defense-in-depth approach to security, the solution incorporates multiple mechanisms beyond those already built into CCIP in order to protect protocols and users.
As in intents-based protocol, solvers are responsible for managing and underwriting costs related to finality risks (i.e., block reorgs) on behalf of users. In exchange for taking on this risk, solvers are compensated in the form of a small percentage based fee derived from the amount of value transferred cross-chain.
At the architectural level, the solution incorporates CCIP as a fallback in the event solvers are unable to fill a userâs transaction on the destination chain. Should this happen, the intents-based solution will switch to failover mode, passing the userâs instruction to abort the transaction from the source to the destination chain via CCIP, along with an acknowledgement back to the source chain. Afterwards, the funds will be released back to the user on the source chain. CCIP is designed with a security-first approach emphasizing determinism above speed or cost. Settlement doesnât need to be fast and transactions can be batched to reduce message counts. CCIP messages are used to enable secure settlement of fast fulfilled transactions, which combines industry leading security with lightning-fast UX.
Native m-of-n Bridge Support
CCIPâs defense-in-depth architecture provides its own version of m-of-n bridging through the use of multiple independent decentralized oracle networks (DONs), as described previously.
The intents-based solution will also be built to provide all the necessary functions with little-to-no additional trust assumptions. It is built to combine the fast finality from leading solvers with the battle-tested security of CCIP. Multi-bridge aggregation models that combine different bridge providers for settlement, by contrast, increase rather than reduce the attack surface for a protocol by introducing heterogeneous risks that dilute the security of the overall system, effectively reducing its security to that of the weakest component. Incorporating multiple bridge providers also significantly increases monitoring and maintenance costs as well as user fees, while also reducing both the composability of assets and the ease of programmatic transfers.
Combining Messaging and Bridging
Chainlink CCIP was built from the outset to enable the simultaneous transfer of both tokens and messaging. This capability, called Programmable Token Transfers, enables smart contracts to transfer tokens cross-chain along with instructions on what the receiving smart contract should do with those tokens once they arrive on the destination chain. Users can send tokens, arbitrary data, or tokens and arbitrary data via CCIP with the same interface. This capability is built into every chain integration with CCIP.
The intents-based solution for GMX is similarly designed to bundle both tokens and data, though the mechanisms specific to high-speed transactions are slightly different. Solvers within the intent infrastructure execute fulfillment in all directions. The userâs CrossChain request will emit an event including the Router address and calldata to be executed. The solver will fund and execute the transaction on the other side.
8. Conclusion
This proposal presents a CCIP-based intents solution for the GMX ecosystem, enabling the secure, fast, and low-cost transfer of tokens/data cross-chain to expand the use of GMX on remote chains. By combining CCIPâs battle-tested security with Acrossâ intents-based bridging, the GMX community will be able to benefit from GMXâs deep liquidity on Arbitrum while transacting on remote chains.
The use of CCIP would build upon GMXâs existing use of Chainlink Data Steams for low-latency market data, introducing little-to-no additional trust assumptions for users as it operates on the same battle-hardened Chainlink platform that already secures tens of billions in DeFi TVL and has enabled trillions in transaction value. GMX would also benefit from the solutionâs support for high configurability and ability to adapt to new intent systems and solvers over time to prevent fragmentation.
We look forward to expanding our collaboration with the GMX community and driving toward the creation of a truly open, low-friction, and interoperable DeFi economy.
Disclaimer
Chainlink Labsâ work is offered âas isâ without representations, guarantees, or warranties of any kind, on a commercially feasible basis and subject to GMXâs acceptance of the Chainlink Labs terms of service and the Chainlink Foundation terms of service. The benefits are solely being made available to GMX and not to any other party.