Just looked at the IBC / cross-chain message passing system, and the more I look at it, the more I think that the question of "who to trust in a cross-chain transfer" isn't that mysterious: it's not just about the bridge contract itself, but also about trusting the light clients / validator set updates on both chains, whether relayers honestly forward messages (or simply block your messages), plus how the application layer handles replay attacks / timeouts. To put it simply, what crosses over is a "proof," but what you trust is every screw in the entire proof chain. By the way, I want to complain that many on-chain data tools' labels are still quite lagging, and can even be influenced. Now, whenever I see conclusions like "certain bridge is insecure / certain address is risky," I instinctively double-check with more audits and reviews... Cautious as a cat, but I still want to click around a bit.