@StellarGuard
I agree with you about the way to go. Still, I believe full trustlessness is indeed possible. Here's an attempt at describing it:
If we assume the foreign block chain support multisignature, both sides could be handled by a quorum of signers that would have to agree over 70%.
If foreign crypto is sent to deposit address, each quorum node sign the transaction to emit equivalent amount to linked stellar account. Signatures are gathered on chain and each node may attempt to validate it.
This is the easy side.
Now if stellar equivalents are sent to the anchor address, they're are burned and each quorum node sign a transaction to transfer the equivalent amount on the native chain. Here it should pick one of the deposit address to do so. It should be algorithmicaly determined so all nodes pick the same. Again, we gather the signatures on-chain and each node may send validation to the native chain.
The incentive for node runners to keep it healthy is shared profit from withdrawal fees.
This is the simple case, were foreign chain allow multi-signature. I assume it's rarely the case. Alternative solution may exist using smart-contract or multi-party encryption of the private keys, but I can't get how.
In this scenario, a valid deposit address for the foreign currency would be an address that have each quorum node as a signer. An independent entity could be needed to check if a deposit address is valid or not.
Do you see any flaw?
Edit: Here, I assume that the quorum nodes doesn't communicate directly with each other. They should all build and sign the transactions independently in a predictable way, so they end up signing the same thing. This is to prevent security breach propagation and to allow very tight firewall rules.
