<aside> 💡 Assessment conclusion

The analysis of Axelar concluded that it conditionally satisfies the requirements of the Uniswap DAO's cross-chain governance use case, as outlined in the Assessment Framework. Axelar employs a proof-of-stake mechanism with sound cryptoeconomic guarantees to secure the protocol. Various aspects of the design of the protocol appear to be well-considered. The size of the validator set and the thresholds for ensuring safety and liveness are sufficient. Its technology stack is built to high standards, and the team maintains good development practices, with strong attention to detail and high activity levels for ongoing improvements. A source of concern for the Committee is a 4-of-8 multisig that governs key aspects of the protocol. Axelar has communicated its plans to move away from reliance on this multisig in Q2 2023 and the committee has weighed in on that process. The Committee recommends that the Uniswap DAO adopt Axelar, conditional on a successful transition away from this multisig. Additionally, the Committee recommends ongoing monitoring of updates to identify areas for improvement in the protocol.

</aside>

Architectural Considerations

Technical Summary

Axelar is a general-purpose cross-chain messaging protocol that uses cryptoeconomic guarantees for security. The protocol employs a delegated proof-of-stake mechanism and a permissionless set of validators coordinated through a Tendermint-based blockchain network. Validators are incentivized with block rewards. If they deviate from the protocol or experience extended downtimes, they are penalized through slashing and forfeit rewards. This incentivizes validators to operate performant and secure validator nodes and behave honestly. The protocol's safety and liveness guarantees stem directly from the financial stake of the validator set and the in-protocol mechanism that governs their behavior.

Axelar's validator network comprises of 70 active validators selected from a larger pool based on the size of their stake and operational track record. While not all validators validate each chain, all chains relevant to Uniswap have at least 66 validators. The asset staked by validators is a bridge-specific token, AXL, which had a circulating market cap of approximately $123m at the time of writing (24 May 2023). Currently, the FDV is approximately $450m and validators in the network have staked approximately 698m AXL tokens, worth roughly $315m. While the distribution of stake across the validator set does not appear to be highly concentrated at present, this could change over time.

Axelar employs a quadratic voting mechanism to achieve consensus. This approach helps to distribute voting power more evenly across validators and mitigate risks associated with the concentration of stake distribution and centralization. The protocol sets a 60% safety threshold by quadratic share of voting power, which, with the current distribution of stake, requires at least 30 out of 70 validators to sign a message for it to be considered valid. If this quorum of validators is compromised or colludes, fraudulent messages could be submitted and executed. Similarly, if a bug or vulnerability in the protocol enabled spoofing a quorum, then safety could be compromised. Furthermore, under the current distribution of stake, the protocol’s liveness would be impacted if roughly 19 validators failed simultaneously. This same threshold of validators could censor messages if they choose to do so.

The protocol offers significant level of visibility into the operations of its validators, and the relevant security parameters that govern the Axelar network. This includes stake distribution, voting power, uptimes, slashing, and other realtime metrics. This enables auditability and significantly increases accountability. It is also worth noting that although the validator set is permissionless, the current set of active validators seems to consist mainly of identifiable entities, many of which are well-known businesses that operate core blockchain infrastructure, such as staking services.

The Committee concludes that Axelar's validator set is sufficiently decentralized, and its cryptoeconomic guarantees around safety and liveness are presently adequate. Overall, the design of the validation mechanism and other architecturally significant elements of the protocol appear to be well-considered.

Risks and Concerns

• A notable limitation of the protocol's cryptoeconomic guarantees is that it cannot protect against a scenario in which a 60% quorum of validators by quadratic share of voting power collectively violate safety. Since the validator set is permissionless and the total value secured by the protocol may far exceed the amount staked by the quorum of validators, it's possible that a set of active validators could theoretically mount a profitable economic attack on the protocol. The quadratic voting mechanism and the amount of locked tokens, along with the required duration for such an attack to play out, currently make this type of attack difficult to execute in practice.
• The AXL token is a token specific to the bridge, with narrow utility and demand, low trading volume and market cap. The volatility of its token price could diminish its cryptoeconomic guarantees or exacerbate the economic attacks discussed above. The team is working towards backing the security of the protocol with a basket of assets that include tokens from other Cosmos based chains.
• Stake distribution can be fluid and may result in a more concentrated validator set over time. While the the quadratic voting mechanism mitigates some of the concerns related to this issue, it does not address all of them. Theoretically, a single logical entity could own multiple validators and a proportionally large stake, leading to centralization and diminished security properties of the protocol.
• As not all validators validate every network, some networks may end up having fewer validators over time. As Uniswap expands to more nascent chains, the Committee recommends paying attention to the size of the Axelar validator set for those chains.

The protocol requires that a 60% voting power, across the global validator set, be achieved for a cross-chain message to be considered valid, regardless of the size of the subset of validators that service a specific chain. This means that while safety is not directly impacted by smaller validator sets, liveness thresholds could be diminished.

• The safety and liveness thresholds described in Axelar's whitepaper seem to be outdated. The Committee suggests that the team publish an updated version soon.

Implementation Considerations

Technical Summary

The Committee conducted a thorough review of the protocol's implementation. This included examining both the smart contracts for EVM chains and the validator network code, all of which are open source. Our analysis indicates that the implementation is sound and aligns with the protocol's specification and technical documentation. Additionally, the Committee found that the internal design of the components is well thought out and in accordance with best practices. Overall, these observations suggest a mature and carefully considered codebase.

Other observations of the protocol's implementation include:

• A number of audits from numerous well-known security firms on different aspects of the system, with varying levels of scope. All high or critical severity issues have been resolved.