How Does Chainflip Work?
Chainflip is a cross-chain DEX enabling native asset swaps (BTC, ETH, SOL) without bridges or wrapped tokens, using MPC/TSS vaults controlled by a validator set. With ~$11M TVL, $1.24B cumulative swap volume, and $80K/week in FLIP burn from fees, it has established meaningful traction. The protocol recently expanded into cross-chain lending (BTC collateral). The B- grade reflects its novel MPC vault approach and new lending feature adding complexity, balanced by comprehensive documentation and growing track record.
TVL
$3M
Sector
DEX
Risk Grade
B-
Value Grade
C
Core Mechanisms
8.1.1
NovelMPC/TSS vaults controlling native assets across Bitcoin, Ethereum, Solana — validators hold key shares for threshold signing
Native cross-chain custody without wrapped tokens; validators collectively manage vault keys via threshold signature scheme
4.1.1
Cross-chain AMM with JIT (just-in-time) liquidity and range orders for native asset pricing
AMM pools price cross-chain swaps; LPs provide liquidity for native asset pairs
3.2.1
Validator staking with FLIP collateral — validators participate in authority auctions for active set
Validators stake FLIP and compete in auctions for slots in the active authority set
1.3.2
FLIP buy-and-burn from network swap fees — $80K/week in FLIP burned from fee revenue
Swap fees used to buy FLIP from market and burn, creating deflationary pressure
2.1.2
Percentage-based swap fees on cross-chain trades distributed to protocol operations and FLIP burn
Fee model funds validator rewards, LP incentives, and token burn
6.1.1
Native BTC lending — deposit BTC as collateral to borrow USDC/ETH/SOL on other chains (launched Feb 2026)
New lending product extending protocol beyond swaps into cross-chain lending
How the Pieces Interact
Validator set controls MPC vault key shares — if validator incentives (FLIP staking) become insufficient relative to vault holdings, rational validators may collude to extract vault funds
Adding lending to MPC vaults that already manage swap liquidity increases the value controlled by the same validator set, raising the incentive for vault compromise
Cross-chain AMM pricing depends on accurate cross-chain state — settlement delays across Bitcoin/Ethereum/Solana could create arbitrage against LPs
FLIP burn reduces circulating supply used for validator staking — excessive burn could reduce staking participation and weaken validator security budget
Swap fees may be insufficient to compensate LPs for adverse selection from cross-chain arbitrageurs who exploit latency between chains
What Could Go Wrong
- MPC/TSS vault security is the single point of trust — compromise of threshold signatures controlling native BTC/ETH/SOL vaults would drain all locked assets
- Cross-chain native asset swaps introduce settlement complexity — partial failures could leave users with incomplete swaps
- Validator set controls vault key shares — collusion or coordinated attack on validators could access vault funds
- New lending feature (BTC collateral, cross-chain borrows) significantly increases protocol complexity and attack surface
Validator Collusion Drains MPC Vaults
TailTrigger: Sufficient number of validators collude or are compromised to reconstruct vault private keys via threshold signatures
- 1.Coordinated validators reconstruct vault keys for Bitcoin, Ethereum, or Solana vaults — Unauthorized access to native assets held in protocol vaults
- 2.Vault funds drained across affected chains before detection — All user deposits and LP funds in compromised vaults lost
- 3.Remaining vaults halted as emergency response — All cross-chain swap and lending functionality frozen
- 4.FLIP token price crashes as protocol insolvency becomes apparent — Validator staking becomes worthless; remaining honest validators exit
Risk Profile at a Glance
Overall: B- (34/100)
Lower score = safer