Hop Protocol - A Hare, or a Tortoise?

Rollups and Composability

Rollups allow Ethereum to scale by moving the execution of transactions to a separate chain and then batching them together to post to the L1 (Ethereum). One notable tradeoff here is liquidity fragmentation; when all activity is on a single layer there is one representation of each asset and all protocols can make use of the same tokens. You lose this when having separate layers. For example, while Optimism and Arbitrum both roll-up to Ethereum, their representations of the native asset ETH are not entirely fungible. When users deposit to Optimism they are using oETH, Optimism’s canonical representation of ETH, and when moving to Arbitrum, aETH. While both of these are backed by ETH they are not 100% fungible, and for a user on Arbitrum who wants to use their ETH on Optimism they will need to exit to the layer 1 before sending back through Optimism’s native bridge.

So herein lies the problem. You can send ETH back through the bridge and wait 7 days to use another rollup, or you could wrap and bridge the Optimism version of ETH to Arbitrum, which would have a different risk profile from ETH on Arbitrum and lose out on composability within the Arbitrum ecosystem. oETH on Arbitrum would not be fungible with the canonical version of ETH on Arbitrum (aETH) meaning that people using this version on Arbitrum would be taking on idiosyncratic risks that aETH would not have (Optimism risk and bridge risk). Such fragmentation is also highly unpleasant from a UI/UX perspective both for app developers and users. Obviously, neither of these solutions is viable.

Enter Hop

This is where Hop comes in. Hop is a bridge for Ethereum L2’s to efficiently communicate and send assets between them. The protocol revolves around the Hop bridge and Hop tokens. Hop tokens are Hop versions of tokens like ETH (hETH), DAI (hDAI), USDC (hUSDC), etc. They are created by depositing the asset in the Hop bridge contract on Ethereum L1 and then minted on a rollup. These hTokens are then able to be used across different L2’s (and sidechains) connected to Ethereum and traded for the canonical asset (aETH, oETH, etc) on each layer. There are 4 main stakeholders in the process and to understand how it works we will need to break them down one by one. These are the liquidity providers, bonders, users, and arbitrageurs.

*Note that for the rest of this report we will be using ETH but the same principles can be applied to any of the other supported assets.

Liquidity Providers

The Hop bridge is what we call “locally verified”, where only the parties directly involved in the transaction verify it while leveraging the use of liquidity pools. LP’s pool assets by depositing ETH through the native bridge contract and the Hop bridge contract. For example, an LP on Arbitrum would deposit ETH through the Arbitrum bridge and ETH through the Hop bridge and then pool them together on Arbitrum. Like any liquidity pool there is potential for impermanent loss, but since the assets are both pegged to the same underlying, it is minimal. LP’s receive 4bps for providing liquidity.

Bonders

Bonders are the glue in the system. Their job is to run full verifier nodes on each chain and facilitate the cross chain/cross rollup transfers for users. Before we zoom in on bonder’s role in the system it’s worth going over a common misconception about OR finality.

ORs propose different finality times for different actors. For full verifier nodes of ORs – who spend the resources to download and execute all rollup transactions – OR transactions are finalized as soon as data behind them are posted on Ethereum which typically happens within minutes. In other words, these nodes don’t have to wait for long fraud-proof challenge periods and can be 100% sure that they won’t be reverted because they fully verify them. Everyone else who doesn’t verify roll-up transactions has to wait for fraud-proofs (or lack thereof) on Ethereum for finality.

Hop bonders belong to the former group. When a user initiates a transfer from the home chain to the destination chain, they fully verify the transfer before others and know that it can’t be reverted w/o having to wait for the fraud-proof challenge period. As such, they act on it with full confidence by fronting tokens to swappers at the destination out of their own pocket in exchange for a fee.

Bonders front liquidity at destination in the form of newly minted hTokens. In order to prevent malicious activity, Bonders are required to lock their hETH as collateral in a contract before they can mint new hTokens to service transfers. Bonder’s hETH collateral remains locked for 24 hours. During this period any fully verifier rollup node can submit a fraud-proof to Ethereum and slash Bonder’s collateral.

You may have noticed that the Hop challenge period of 24 hours is much shorter than the Optimistic rollup period of 7 days. This is a design choice by the Hop team to make the bridge more capital efficient but does add a new trust assumption. Before we dive into the motivations behind this choice and the risk factors involved, we shortly re-visit the security mechanism of ORUs.

The main trust assumption Ethereum ORUs make is that any single honest party can issue a fraud-proof which will be mined on the Ethereum base layer within some predefined period of time. Optimism and Arbitrum each chose this time to be 7 days. The motivation here is to allow a reasonably long time for participants to coordinate off-chain, to account for the extreme case where for whatever reason a fraud-proof can’t be issued or is getting censored by miners. As such assets bridged over from Ethereum to Arbitrum or Optimism via their respective native bridges have to wait the full 7-day challenge period to bridge back to Ethereum.

Unlike native Rollup bridges which have a 7 day challenge period, Hop bridge has a challenge period of 1 day. This enables Hop Bonders to rebalance their liquidity across rollups in the form of Hop tokens (hETH, hDAI etc.) using the Hop bridge 7 times faster than they could have done using the native Rollup bridges. The downside is that Hop token holders accept a 7 times shorter challenge period, which means it’s 7 times less costly to censor fraud proofs on the base layer. Now that we’ve covered how Hop bridge differs from native Rollup bridges let’s dive into the motivations behind the Hop team’s decision to accept a shorter challenge period for their bridge.

First, users of the Hop bridge have a different risk profile than users of optimistic rollups. While users on OR’s are subject to the challenge mechanism (ie fraud proofs) of the native rollup bridge working at all times, users of the Hop bridge are only exposed to risks of the Hop bridge while using the bridge. Once they have their desired asset on their desired chain, they no longer bear the Hop bridge risk. Second, Hop issues their own tokens. The point of Hop is to have liquidity ready on chains when it is desired without going through the native bridge. Hop could work without the hTokens and AMM, but that would mean that bonders would need to lock their liquidity for 7 days, greatly reducing the capital efficiency and increasing costs to the system (you would also no longer need LP’s or arbitrageurs). The three parties that take on the shorter challenge period risks are LP’s, Bonders, and Arbitrageurs; users are the protected stakeholder. This is why users pay fees and the other 3 parties earn them. Bonders take anywhere from 6-25bps depending on how many transfers for a particular asset & chain are taking place.

The main determinant in the fees bonders charge depends on the number of transfers. Hop works around “transfer roots”, a bundle of transactions. The more transactions bundled, the cheaper for end users. Transfer roots still need to go through the L1 and thus are slow to process, and that’s why the bonding and “fronting liquidity” above are needed. Simply put:

1. User initiates a cross-chain transfer
2. Bonder verifies transfer, locks in collateral & fronts liquidity to the user at destination in exchange for a fee
3. Users get their assets on desired chain w/o waiting
4. Bonder has collateral unlocked after 24h if unchallenged

Users

Now we get to the most important stakeholders, the users. They face minimal risks and pay the fees the LP’s, Bonders and Arbitrageurs earn. This is where we’ll put it all together using a simple example.

1. Alice has ETH on Arbitrum but she sees that Optimism just launched their OP token and rewards have opened for some pools. She knows that the high APY’s will not last long and thus cannot wait for the 7 day exit period to withdraw her ETH from Arbitrum.
2. Alice decides to use Hop. She swaps her aETH in the Hop AMM on Arbitrum for hETH which is then sent to the Hop Bridge and burned.
3. The bonder verifies this transfer (by running a full node) on Arbitrum and locks their hETH on Optimism to mint hETH.
4. Newly minted hETH is sent through the hETH/oETH pool on Optimism to Alice.

For Alice, her interaction with the bridge is now over. She has Optimism’s canonical ETH token and can start farming for OP tokens. As for the bonder, their hETH that was locked on Optimism will be unlocked after 24 hours if no successful challenges. During this process Alice would have paid:

1. Arbitrum gas fee
2. Optimism gas fee (calculated up-front)
3. 4bps swap fee to Arbitrum LP’s.
4. Slippage on Arbitrum AMM depending on pool balance and size.
5. 6-25bps fee to Bonder depending on asset (ETH usually 5bps, USDC/DAI 13bps, USDT >20bps)
6. Slippage on Optimism AMM depending on pool balance and size.
7. 4bps swap fee to Optimism LP’s.

Not cheap. However, Alice was able to get quick execution in a risk-minimized way to move funds across rollups. The main risks a user would face are smart contract risks or more systemic risks with the rollups that they would be exposed to regardless. The most common issue users could face is that bonders are offline or do not facilitate their transaction. While not desired, the worst case here would be needing to wait for the Optimistic 7 day exit time. There is a small edge case where users could be using the bridge during a 5-10 minute period where a fraudulent transfer root reaches 24 hours unchallenged, leaving Hop undercollateralized. This is extremely unlikely to happen because it would require a failing of the challenge mechanism and the user would need to be using it in that exact time window, but it’s still worth noting. All bridges have some amount of risk to them, Hop is far towards the safer end.

Once this transfer is complete the pools will be out of balance. Remember, ETH was sold on Arbitrum and it was bought on Optimism. Both of these pools will have their peg changed depending on available liquidity and volume. This is where the last stakeholder comes in, the Arbitrageur.

Arbitrageurs

The last piece of the system is the arbitrageurs. They reduce costs for users by rebalancing pools on each chain. Using our prior example of the launch of the OP token, you can imagine an upcoming scenario where you have a lot of users looking to exit Arbitrum to Optimism all at the same time. Without arbitrageurs, the aETH on Arbitrum would start trading for less and less oETH on Optimism: The hETH side of the pool is being depleted on Arbitrum, lowering the amount of hETH a users gets for aETH, and the oETH side of the pool is being depleted on Optimism, lowering the amount of oETH a user gets for hETH. This increases the cost of slippage for users moving chains. Arbitrageurs will step in by depositing ETH through the Hop bridge for hETH on Arbitrum and then swapping for aETH at the higher rate. They can then send that ETH back through the Arbitrum bridge, wait the 7 days, and repeat. Arbitrageurs take on the opportunity cost of bridge transfer times to make a risk-free (excluding usual smart contract/Hop/OR risks) profit. On Optimism, they would go the opposite route, depositing ETH through the Optimism bridge, selling the oETH at a premium to hETH, and withdrawing back to L1 through the Hop bridge.

The other benefit to having arbitrageurs is that without them, bonders would need to price the aETH/oETH peg themselves. Having pools and arbitrageurs frees them from this task. Looking at the history of Polygon, pegs have usually stayed within a range of 25bps and almost always within 50bps outside of a few cases. The USDC peg is tighter due to its liquidity. To further help, the Hop team is planning to automatically route users through either the Hop bridge or canonical bridge when depositing to L2, a way to rebalance the pegs naturally. This means that users would not need to use the Arbitrum or Optimism bridge UI’s after this implementation – Hop would always have the better rate (if Hop pools are imbalanced and offering 1.005 aETH for ETH it will be strictly better than using native bridge at 1:1).

Who Bears the Risk?

As mentioned, users are the protected stakeholder in Hop and the worst thing they are likely to encounter would be a bonder offline and having to wait. LP’s, Bonders and Arbitrageurs face the more serious risks. The main tradeoff Hop makes it shortening their challenge period from 7 days to 1. This is an additional trust assumption of the bridge that makes it a bit less secure than the underlying rollups in order to gain improvements in capital efficiency. However, since bonders run full nodes they can 100% verify a transaction is valid when they receive it.

The largest risk/edge case is if a bonder is able to submit a fraudulent transfer root that goes unchallenged for 24 hours. In this case the system would be undercollateralized and anyone holding hTokens or Hop token either directly or indirectly would be affected. This is a similar risk that Optimistic rollups face (albeit with a 7 day challenge period). To prevent this, watchers can submit challenges within the 24 hour period and if successful earn 7.5% of the value of the transactions in the fraudulent transfer root. Remember, bonders must stay fully collateralized during this period and so if they try to submit a fraudulent root that gets caught they lose their capital. This setup is highly secure but as with any system is not foolproof. Other risks participants face are general smart contract risks with the protocol and risks with the underlying rollups or less-secure PoS chains. You may have noticed that while Hop is focused on L2’s, it currently supports non-rollup sidechains like Polygon and xDAI. While interacting with these chains is indeed less secure for our 3 key stakeholders, users are still isolated. If Polygon or its bridge were to get hacked the impact would be isolated to the LP’s on Polygon. The way the Hop contract works is that you cannot exit more hTokens than what has been entered, keeping hTokens across all other chains fully collateralized if one has an issue.

In summary, Hop is a (mostly) trustless bridge that relies on 3 key stakeholders to keep it functional. The main focus is Ethereum rollups, allowing users to move between them without ever touching L1, all while benefitting from Ethereum’s security. When discussing bridge security the main aspect we want to focus on is who controls the bridge and what the weak points are. For Hop there are no added trusted parties/validators/signers, etc., just a more aggressive challenge period. Now that we understand how the bridge works it’s time to look at how Hop has performed over the past year, how it stacks up against other bridges, and finally, the upcoming launch of the Hop token.

A Year of Hopping

It has been about a year since the Hop protocol launched, originally on the PoS sidechains xDAI and Polygon, and later in the year on the L2’s Arbitrum and Optimism. Usage did not start to spike until the L2’s became more used. Since Polygon and xDAI are sidechains and thus not subject to the same exit times as optimistic rollups, there was not a critical need for Hop; this changed with the L2’s.

Looking at the monthly volume, Fall of 2021 is when Hop went from doing less than $50M/month to what is now consistently in the $250-300M range. It’s done >$2B of volume since inception, hitting the first billion in January and the second in early May. As we see below, this directly correlates with the L2 launches.

Once again, volume spiking with the L2’s is no surprise as the main bottleneck Hop is solving for is the L2 withdrawal times. xDAI and Polygon don’t have the long exit times that rollups do and thus aren’t critical integrations; they were onboarded more so as test launches in the early days of Hop but they’re not the main long-term focus. While L2’s on Ethereum have had somewhat of a disappointing start there are some catalysts on the horizon, most notably the OP token from Optimism. Hop’s TVL on May 11th by chain was:

• Ethereum: $67.6M
• Arbitrum: $16.6M
• Optimism: $10.1M
• Polygon: $7.8M
• xDAI: $4.1M

The entire Polygon chain has TVL of $3.65B, approximately double Arbitrum’s $1.68B and 10x Optimism’s $372M, yet it has less TVL on Hop than both, again highlighting that Hop’s main customers are L2 users. Hop has continued to see steady growth in unique addresses and is approaching 100k, being in a consistent uptrend since the end of 2021, a good sign given Hop being more expensive than counterparts and not incentivized.

Users are less asset sensitive and more liquidity sensitive when bridging, thus we would expect bridge volumes (and TVL) to converge towards major assets. Hop users predominately demand USDC and ETH, which is no surprise given ETH’s role in the eco and Ethereum users’ preference for USDC. While Hop can add more assets in the future, this would require more LP pools, more Bonders, and higher slippage on those assets. It is likely that most volume will continue to flow through USDC and ETH.

So how does Hop stack up against other bridges?

The Bridge Wars

Crypto always needs a narrative. For 2020 it was DeFi, for 2021 it was L1’s, and for 2022 it has been bridges. Prior to 2021 when nearly every user was on Ethereum L1, bridges were an afterthought. Over the past year with multiple L1’s like BSC, Polygon, Avalanche, Solana & Near, and L2’s like Optimism and Arbitrum, bridges have become front and center. Sometimes painfully so, as we have seen with the Wormhole and Ronin bridge exploits.

At first glance it may seem like Hop is far behind other bridge leaders, which is true to an extent. But we should acknowledge that Hop’s design and target market is fundamentally different from others.

Bridges will be one of, if not the most, important pieces of infrastructure in the crypto economy over the coming years. Many today are not built as safely as we would desire, often making convenience tradeoffs, whereby in better cases relying on an honest majority of staked operators or in worse cases a PoA multisig or even a single party. This is not an ideal long-term solution. In the modular world we are moving towards bridges that can and will be secured by honest minorities. This is a paradigm where a single fully verifying actor can protect everyone else.

Hop squarely fits into this world. It’s distinctly focused on rollups. Naturally their target market today is much smaller than the others; Arbitrum and Optimism only have ~$2B TVL combined. By focusing on rollups Hop can take a risk-minimized approach and leverage the security guarantees that Ethereum provides. Unlike its peers such as Multichain, Stargate, Wormhole, CBridge and Synapse it can even resist majority collusions. While there is a larger market to going after multiple environments you introduce new risks and tradeoffs that come with additional trusted parties (multi-sig holders/network validators). Hop is focused on becoming the leader when it comes to rollup to rollup transfers and is betting on the Ethereum ecosystem directly. It won’t be the leader in multi-chain bridging, nor does it try to be. By being the “connector” for rollups they can keep the design simple, safe, and scalable.

Next, Hop is one of the only bridges without liquidity mining rewards. Over the past year all of the volume and TVL was organic and APY’s for being an LP were low (you could argue some LP TVL was “pre-farming” for a future airdrop). LP’s received just 4bps swap fees and no token incentives. To contrast this, we can look at the TVL for Stargate around launch in late March, getting up to $4B on positive token price action and then matching the decline on the way down. Stargate’s entire TVL is stablecoins so the effect of crypto market volatility in the TVL is minimized. It simply attracted a large amount of capital by incentivizing it. Token price up → APY up → TVL up → APY down → token price down → APY down → TVL down. It’s no secret that the TVL it has obtained so far is mostly due to the incentives.

Now, this isn’t to say that Stargate or LayerZero are not legitimate projects, quite the contrary, they are an ambitious project going after a massive market, trying to link all chains together. We use them as an example here just to highlight something that occurs all too frequently in crypto, protocols looking like they’re getting organic usage when really they’re just paying for users. This is why comparing protocols purely on something like TVL without the nuances can be misleading. Hop has been impressive so far in how it has onboarded users, being deeply ingrained in the Ethereum community and sharing those same values; a focus on security first and Ethereum first. This is their competitive advantage and why they’re laser focused on Ethereum and their L2’s. With the optimistic rollups starting to get more adoption and zk rollups due to pick up steam over the coming years, Hop’s addressable market will continue to expand.

Competitive Challenges

With all that being said, the competitive landscape of bridges will continue to be a challenge for Hop. While in theory we would expect liquidity to flow to a few bridges (like most sectors in crypto), it will take a while until we get there. With all of the bridge exploits that have happened so far (Multichain, Portal, Ronin) people will want to diversify their bridge exposure, and there will be numerous design implementations until consensus starts to settle on what the optimal tradeoffs are. A key factor here is whether or not we move to a truly multichain world, with numerous L1’s, or more of an Ethereum world dominated by rollups. Hop is betting on Ethereum and their L2 roadmap, and for that niche, they are the clear leader.

Outside of the risk of L2’s not taking off as expected, the main risk for Hop is that the other multi-chain bridges end up being good enough and that we do get a multi-chain world where people think not about going between L1’s and L2’s, but just going between chains. A true chain-agnostic, multichain user who uses Aurora, Avalanche, Avalanche subnets, Arbitrum and Optimism may prefer to use a solution like Synapse because it caters to all their needs. Are they going to seek out to use Hop when moving between L2’s but Synapse for the others? It’s possible, but what tends to be most likely is that users get familiar with a product and stay with it for convenience (in the future we would expect bridge aggregators to play a larger role here as well). For LP’s, which you could argue are the real customers of a bridge, they care about returns and security, and if the other bridges offer higher returns and good enough security guarantees then they won’t be as eager to provide liquidity through Hop.

Hop’s selling feature is a highly secure rollup transfer network. It purposefully avoids connecting to every chain and instead focuses on being the leader of Ethereum L2’s, leveraging the security Ethereum provides. Whether or not the market will appreciate Hop for this is unclear, and as stated previously, a lot of their success will depend on how much activity moves to Ethereum L2’s vs other L1’s. The L2’s have lagged in this regard, but with the market downturn and Optimism launching a token (rumored for end of May or early June), we could see a flight of capital back, especially if this leads to other L2’s launching tokens as well. It is possible that with recent events we may even start to see somewhat of a “flight to security”, something less thought about in the bull but becoming more prevalent in the bear.

The Hop DAO

On May 5th Hop announced the upcoming launch of their token and with that, the Hop DAO. 39% of the supply is allocated with the remaining 61% up to the DAO. Important to note here is that the DAO tokens are unallocated, not earmarked for a future unlock date. Since holders of HOP will be voting on the usage it is against their interests to have wasteful supply issuance and dilute themselves. When looking at FDV’s it is crucial to understand what is guaranteed to hit the market and what could hit the market. Hop’s treasury is the former. The team’s 22% share and investors’ 6% share have 3 year vesting with a 1 year cliff. The airdrop allocation of 8% will be split between:

• Bridge Users: 3.35%
• LP’s: 2%
• Bonders: 2% (1 year lock)
• Early Evangelists: 0.1%
• Contributors: 0.05%
• Authereum Users: 0.5%

At launch the circulating supply will be the unlocked portion of airdrop tokens, ~6%. The circulating supply over the first year will be this 6% plus whatever the DAO decides to use the treasury for; in year two the team and investor tokens will start unlocking.

As stated earlier, Hop did not have liquidity mining rewards for the first year, however… Sybil attacking airdrops has become a full-fledged business. Due to the lucrativeness of airdrops, there are now entities whose entire business model is bot farming and Sybil attacking protocols without a token to receive a potential future airdrop. We’re talking airdrop rewards on the order of hundreds of millions of dollars. To combat this, the Hop team spent two months analyzing addresses and were able to identify 10,253/43,058 (24%) Sybil attackers, removing them from the distribution and in turn giving more to real users. Next, and this is where it gets more interesting, is they opened up a second leg of Sybil hunting for the community. If community members are able to identify legitimate Sybil addresses then they will receive 25% of those tokens allocated to those addresses. At the same time, Sybil hunters can turn themselves in and keep 25% of their allocated tokens. So, they can say nothing and hope no one catches them for the full 100%, or turn themselves in and keep 25%. The response so far has been great to see. In a week after the initiative was launched, 900k HOP (1.1% of Airdrop allocation) have been identified as Sybil attackers. One hunter was able to identify 471 Arbitrum addresses earning 81k HOP and another was able to link 97 addresses to a single Polygon funding address (map below). Hop is the first protocol to incentivize community Sybil hunters, and with the engagement and success they’ve seen, doubtful that they’ll be the last.

As for the usage of the token itself, it will start out as a pure governance token, managing things like the L2’s/chains supported, token incentives, bonder whitelist, grants, treasury funds, and more. One critique against Hop is that the bonders are few and centralized. Before v2 where this becomes permissionless, the whitelist management will be handed to the DAO. For the next few years we should expect HOP to be purely governance without any fee-type extraction. First off, any added rent-extraction would be detrimental for users today, and while we’ve seen some protocols successful in implementing fees it is usually due to paying out more than the fees earned in token rewards. Second, Hop and L2’s are still very early days. As noted prior, Arbitrum and Optimism have just $2B TVL combined and the zk rollups are still in primitive stages. $2B TVL is where Ethereum L1 was in July 2020! The case for Hop is to be the transfer layer between all of these L2’s, a multi-year process with the goal to be the main portal moving hundreds of billions of dollars throughout the Ethereum ecosystem in 3-5 years.

Tortoise or the Hare?

The first year of Hop saw stable and steady growth but was hampered by factors out of their control, the main one being the disappointing traction of L2’s. With numerous L1’s launching with their own incentives (both token incentives and dev incentives) it was hard for L2’s to compete and thus other chains and bridges focused on multi-chain saw more success. However, development on L2’s has not stopped, with Optimism and Arbitrum slowly building out their ecosystems and the zk rollups like zkSync, Starkware, and newly announced Scroll starting to take shape. We also have the upcoming Optimism token launch where a portion of supply is allocated to ecosystem partners, a high chance that OP token farming will be available to Hop protocol which should further boost adoption on both Hop and the L2’s. There are more long-term catalysts in the pipeline for Hop as well, like the upcoming v2 where bonders become permissionless, enabling contract calls across rollups for use cases beyond token transfers, and integrations with the zk-rollups.

In an industry where speed is often prioritized over security, Hop has taken a methodical, long-term approach, leveraging the security of Ethereum with the goal of being the default rollup transfer network throughout the ecosystem. Over the coming years as more activity moves off of Ethereum L1 and onto the L2’s we should see Hop continue to play a larger role. Somewhat ironically, the name choice for Hop is a misnomer, being a rare Tortoise in an industry full of Hares. It will take years to truly reach their vision, and there are Ethereum execution risks to consider here, but Hop is being built for the long-term, and the opportunity is there.