IBC light clients in practice

IBC is the original validity bridge. Every connected chain runs a light client of the counterparty chain on-chain, so cross-chain packets are verified against counterparty consensus instead of against an external committee.

The Tendermint light client - the most common one - only needs a signed header and a proof against the corresponding Merkle root. Channels and connections sit on top of light clients, and packet commitments provide replay protection.

Relayers are permissionless and do not need to be trusted, because everything they deliver is verified on-chain. The result is the strongest security model of any message passing protocol in production, at the cost of requiring every pair of chains to maintain a live light client of each other.