Every crosschain message consist of 2 fundamental parts: input data and execution proof. Both must be verified to have a secure crosschain message. Correct input data (from a decentralized base layer consensus protocol) into a faulty execution proof (like a compromised full node) is no good. Incorrect input data (like a sequencer confirmation) into a correct proof system (a perfect, bug-free ZKP) is no good either. You need both and you need to verify both for every crosschain message. 1. Block confirmation depth from L2 sequencers does not give added security against a malicious sequencer. Blocks can be reorged by the sequencer any time before they land on their base layer. 2. Verifying the merkle root of block events is not sufficient. A valid, but incorrect event merkle tree can be constructed from malicious input data. (Though arguably performing this attack is more involved than faking an eth_getLogs call) 3. Synchronous composability is perpendicular. You could have a synchronously composable protocol with weak confirmations and a weak proof system, making it prone to forged crosschain messages. TEEs often get a poor reputation, and they are not perfect, but an RPC running in a TEE that also verified a decentralized block confirmation inside the enclave would seem to have prevented this particular unfortunate incident. Even better, a multisig of TEEs, where each TEE is enforced to be in a different location, cloud provider, and TEE provider could have provided arguably much stronger security for comparable offchain and onchain costs (you verify the TEE attestation once at registration time, then use an ephemeral key onwards which is cheap to verify onchain). The exact RPC binary code would have been attested to onchain, preventing malicious code injection. The end goal is a real-time multi-proof system of both TEEs and ZKPs + a real-time trust-minimized confirmation system. Until ZKPs can match TEEs on cost and latency, we can use TEE proofs up to certain notional thresholds to limit the exposure until a ZKP can be generated.