Pick the trust model before the code
Every bridge answers one question: who attests that an event happened on the source chain? Options include an external validator set with multisig or MPC signing, a light client that verifies source chain headers on the destination, an optimistic design with a challenge window, or a zero-knowledge proof of the source state. Whichever model you choose, write down the worst case: what an attacker could steal, who would notice, how quickly the bridge can pause and who would repay users.
Light client and proof-based designs minimize added trust but cost more gas and engineering time, and are not available for every chain pair. Validator-set bridges are easier to build and cheaper to use, yet their security equals the weakest key holder. We document these trade-offs so you choose with open eyes. After deployment, keep adding independent checks. Two separate monitors that compare locked and minted supply on each chain are better than one dashboard watched by one person.
