Why does a valid signature on one chain still authorize a transfer on another?
機会
Cross-chain bridges sign messages to authorize transfers, but most protocols do not include the destination chain ID or action type inside the signed payload itself. An attacker who sees a legitimate signed message can broadcast it to a different chain or replay it as a different action, and the receiving contract cannot distinguish the replay from a fresh authorization. The CrossCurve bridge lost $3M in February 2026 this way, and replay-class bridge incidents have totaled over $180M with a median six-week window from deployment to first exploit. ERC-7281 standardizes cross-chain token interfaces but does not mandate domain-separated signing across the broader message layer. No enforced standard today requires that every signed cross-chain payload carry a chain ID and action-type commitment that makes re-broadcasting structurally invalid.
重要な理由
Domain-separated signing is the missing primitive that makes a signed cross-chain message valid exactly once on exactly one chain.
機会をどう評価するか
Opportunity Scoreは測定値ではなく、私自身の見解です。どれほど痛みを伴うか、どれほど頻繁に影響を与えるか、そして今日時点で解決策がいかに少ないか。スコアが高いほど、構築する価値が高いと私は考えています。
それが現れたときにどれほどの痛みをもたらすか。
実際にどれほど頻繁に人々がそれに直面するか。
今日時点で、それに対する優れたツールがいかに少ないか。