[review] MIP-50: Insured Native Bridge

[l-monninger]

Summary

MIP-50

[apenzk]

would put this before the previous point since it defines Risk Period

[apenzk]

Suggested change

[MD-38](https://github.com/movementlabsxyz/MIP/pull/38) requests provisions for use of AB-FFS that enable a fixed supply of token. This MIP introduces an Insurance Fund for the bridge which can be used to cover losses. The Insurance Fund will be used to cover losses in the event of a hack or other catastrophic event and can insure a fixed supply of token is maintained.

[MD-38](https://github.com/movementlabsxyz/MIP/pull/38) requests provisions for use of AB-FFS that enable a fixed circulating supply of token across L1 and L2. This MIP introduces an Insurance Fund for the bridge which can be used to cover losses. The Insurance Fund will be used to cover losses in the event of a hack or other catastrophic event and can insure a fixed supply of token is maintained.

[l-monninger]

@apenzk To you point, this MIP needs to further detail the one-sided nature of the security and why that is apt. There is indeed asynchrony between bridge operation and settlement of the L2 on the L1. This means that, without the appropriate information from the informer, you could have state where the insurance fund is activated, but the exploited amount continues to increase.

The informer must, in fact, account for these differences in time. I think it must first indicate the invariant is violated and then wait until the bridge has been restricted to a 0 rate limit to report the loss.

[apenzk]

@apenzk To you point, this MIP needs to further detail the one-sided nature of the security and why that is apt. There is indeed asynchrony between bridge operation and settlement of the L2 on the L1. This means that, without the appropriate information from the informer, you could have state where the insurance fund is activated, but the exploited amount continues to increase.

The informer must, in fact, account for these differences in time. I think it must first indicate the invariant is violated and then wait until the bridge has been restricted to a 0 rate limit to report the loss.

@l-monninger so the proposal is to force a synchronization. This may be workable albeit it is still not clear to me what amount of discrepancy would trigger such a lock-down of the bridge (0 rate limit)