Implementation is actively on-going! Nowadays coding is fast, but making sure that everything works as it should is a bit trickier. So ultimately it’s a slow and methodic process.
I feel lucky that I can compare my solutions with other integrations, just CKB flexibility & state rent are definitely NOT helping out!! 
For example, I just dug out something interesting. Given the following assumptions:
- Rosen Bridge attach on transfers meta-data such as
fromAddressandtoAddress - CKB to OUT transfers are done by storing this data in a cell owned by the bridge (ACP)
- OUT to CKB transfers are done by storing the usual xUDT data in a cell owned by user (normal user cell)
- User addresses length can be up to max block size: ~500KB or more if tx is mined by private miner
Then a CKB user with a long enough address can:
- CKB to OUT: occupy all CKB of the ACP by effectively abusing
fromAddress - OUT to CKB: drain out of CKB an ACP cell or generally any exchange supporting naive CKB tokens withdrawals
Remedies being investigated:
- Not really an attack per se, cause this is not limiting Bridge actions, that metadata information can be lost at the next tx without trouble. That said, if we wanted, we could use
fromAddressto store an outpoint representing user, instead of address. Most of the other UTXO chains integrated in Rosen Bridge adopt this approach. - Bridge Network fee could would pay for a fixed amount of CKB, so user UDT cells get a fixed amount of CKB.
All in all everything is proceeding,
Phroi