Polygon's Agglayer assumes every connected chain could be lying

A bridge built on distrust

Some of crypto's costliest exploits have shared a common flaw: attackers found ways to mint withdrawal claims that no real deposit ever backed. In February 2022, Wormhole was hacked for $320 million after an attacker minted 120,000 wETH tokens by tricking the bridge into believing its guardians had verified a deposit that never existed. A month later, the Ronin Network was drained of around $590 million after an attacker took control of five of the bridge's nine validators to sign off on malicious withdrawals. The pattern is consistent: bridge security breaks when the system extends trust it should not.

@0xPolygon's Agglayer is designed to make that class of attack fail by default. The protocol is built on a single core assumption: every connected chain could be wrong, and the bridge ledger must balance before value moves. Agglayer enforces this with its pessimistic proof, a security model that uses cryptography to check the math of every cross-chain movement before it settles, so a faulty chain cannot spend funds it does not have.

How the pessimistic proof works

Each chain periodically sends ZK proofs of its state to Agglayer, confirming that no chain can withdraw more funds than it has deposited. In official terminology, these are called pessimistic proofs, and they are verified by the aggregator and recorded in the security system. The verification is performed without revealing the underlying transaction data, preserving privacy while enforcing balance.

The pessimistic proof, now live on mainnet, provides a cryptographic guarantee which ensures that even if a chain's security is compromised, it cannot drain funds from other chains. Even though the proof cannot guarantee a chain is doing correct internal accounting, it can ensure that it does not drain other chains in the network. In other words, a compromised chain can lose what it put in, but the damage is contained.

Agglayer's pessimistic proof generation runs through native validation and zkVM proof generation, executes the same state transition logic and then proves it cryptographically using Succinct's SP1 verifier. Constraints include balance conservation, nullifier uniqueness, root consistency, and signature validity.

It is worth noting a key limitation made clear in Polygon's own documentation: the pessimistic proof protects the shared bridge and the broader network from a bad actor chain, but it does not make any individual connected chain more secure internally. Each chain's own security remains its own responsibility.

Polygon Blog: How the Open Money Stack Secures Cross-Chain Value with Agglayer
Polygon Developer Docs: Agglayer
Across Protocol: Why Are Bridge Hacks So Common?