Skip to content
Blockchain

Why does a valid signature on one chain still authorize a transfer on another?

85

Möglichkeit

Cross-chain bridges sign messages to authorize transfers, but most protocols do not include the destination chain ID or action type inside the signed payload itself. An attacker who sees a legitimate signed message can broadcast it to a different chain or replay it as a different action, and the receiving contract cannot distinguish the replay from a fresh authorization. The CrossCurve bridge lost $3M in February 2026 this way, and replay-class bridge incidents have totaled over $180M with a median six-week window from deployment to first exploit. ERC-7281 standardizes cross-chain token interfaces but does not mandate domain-separated signing across the broader message layer. No enforced standard today requires that every signed cross-chain payload carry a chain ID and action-type commitment that makes re-broadcasting structurally invalid.

Warum es wichtig ist

Domain-separated signing is the missing primitive that makes a signed cross-chain message valid exactly once on exactly one chain.

Wie ich die Chance bewerte

Der Opportunity Score ist meine persönliche Einschätzung, keine Messung: wie stark es schmerzt, wie oft es auftritt und wie wenig heute existiert, um es zu lösen. Ein höherer Wert bedeutet, dass ich es für lohnender halte, es umzusetzen.

Schweregrad9/10

Wie viel Schmerz es verursacht, wenn es auftritt.

Häufigkeit7/10

Wie oft Menschen tatsächlich darauf stoßen.

Whitespace8/10

Wie wenig gute Werkzeuge dafür heute existieren.

Weitere lösungswürdige Probleme