Bridge protocol vulnerabilities in disclosed bug bounty reports

The highest-value target class in crypto: concentrated custody plus verification of events from a chain the verifier cannot execute.

Reports indexed: 248
Total paid: $4.5M
Critical: 3
Largest payout: $2.5M

Bridges have produced the largest losses in the industry's history, and the disclosed reports show why: they combine a vault holding pooled deposits with a verification layer that must judge, off its own chain, whether a distant event actually happened.

Findings split cleanly into verification failures — bad proof handling, weak or miscounted signature thresholds, missing source-chain binding — and custody failures, where the mint or release path is reachable without the verification having succeeded.

Payout sizes in this class are consistently the largest on the platform, which makes the payout comparables view particularly useful for bridge submissions.

What reviewers look for

Proofs verified against attacker-influenced roots
Signature thresholds without signer deduplication
Missing source-chain and source-contract binding on messages
Mint paths reachable without a corresponding verified lock
Replay protection keyed on attacker-chosen values

Curated highlights

The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.

criticalSignature replayEVM-Solidity$2.5M

Cross-chain bridge signature replay allows infinite mint

A signature validation vulnerability in a cross-chain bridge protocol allowed valid guardian attestations to be replayed across different destination chains. The signed message digest omitted essential domain parameters like the target chain ID and global emitter sequence, allowing an attacker to reuse a single legitimate withdrawal signature on multiple bridge deployments. Consequently, an attacker could mint unlimited wrapped assets across various target chains without providing additional collateral on the source chain.

Wormhole-style BridgeimmunefiFeb 24, 2023Open

criticalBridge exploitEVM-Solidity$1.8M

Bridge withdrawal proof accepts empty Merkle path

A flawed proof verification mechanism in an L2 canonical bridge contract permitted withdrawal validation using an empty Merkle proof array. When no proof elements were supplied, the verification function failed to iterate and directly compared the unhashed withdrawal leaf against the target root. By matching a fake withdrawal leaf payload with a valid historical or relayable state root, an attacker could forge arbitrary withdrawal events and drain escrowed funds from the bridge.

L2 Canonical BridgeimmunefiJun 2, 2022Open

highAccess controlCosmos-SDK$250k

Cosmos SDK module allows unauthorized state migration via missing ante handler check

A logic flaw in a Cosmos SDK module's state migration handler allowed unauthorized signers to execute privileged state updates. The message authority check relied on a helper function that returned true when the authority field was empty, and the message route was incorrectly exposed as a standard transaction rather than being restricted to governance. An attacker could issue state updates with an empty authority field to inject malicious counterparties into the IBC channel allowlist, enabling the execution and processing of forged cross-chain transactions.

IBC App ChainimmunefiDec 5, 2023Open

mediumAccess controlEVM-Solidity$0

The Graph: Governor can rug pull the escrow

The Graph's BridgeEscrow exposes an approveAll() function that the protocol governor can call to grant any address an unlimited allowance over the escrowed GRT. Because the escrowed tokens are never burned, a compromised or malicious governor could permanently drain the full L1 balance, and even an honest governor forces users into a perpetual trust assumption over the funds. The sponsor disputed the finding as intentional design meant to support multiple future bridges and emergency recovery after a critical Arbitrum incident, and the judge leaned toward closing it as invalid while noting Code4rena's convention of awarding such centralization risks as Medium for awareness. The disclosure thus represents a contested governance/centralization-risk concern rather than a directly exploitable vulnerability.

The Graphcode4renaAug 7, 2026Open

mediumAccess controlEVM-Solidity$0

The Graph: Initialize function in `L2GraphToken.sol`, `BridgeEscrow.sol`, `L2GraphTokenGateway.sol`, `L1GraphTokenGateway.sol` can be invoked multiple times from the implementation contract

The Graph's upgradeable proxy contracts — L1GraphTokenGateway, L2GraphTokenGateway, L2GraphToken, and BridgeEscrow — expose initialize functions protected only by an onlyImpl modifier rather than OpenZeppelin's initializer guard. If the implementation is ever callable by an attacker (e.g., a compromised or rogue implementation), the functions can be re-executed to point the contracts at an attacker-controlled controller. Because the onlyGovernor modifier resolves against that controller, the attacker gains governor privileges and can call BridgeEscrow.approveAll to grant an unlimited GRT allowance and drain escrowed bridge funds. The sponsor confirmed the finding, awarded Medium severity, and fixed it in graphprotocol/contracts PR #741 by adding the initializer guard to all four contracts.

The Graphcode4renaAug 7, 2026Open

mediumInteger overflow/underflowEVM-Solidity$0

The Graph: After proposed 0.8.0 upgrade kicks in, L2 `finalizeInboundTransfer` might not work

The Graph's L2GraphTokenGateway restricts finalizeInboundTransfer to calls arriving from its L1 counterpart gateway, verified via applyL1ToL2Alias, which intentionally wraps the L1 address plus a fixed offset into the expected L2 sender. The protocol planned to upgrade from Solidity 0.7.6 to 0.8.0, whose built-in overflow checks would cause that deliberate uint160 wrap to revert whenever the sum exceeds UINT160_MAX. Because the L1 gateway's address can trigger such an overflow, the modifier would reject legitimate inbound transfers after the upgrade and break L2 deposit finalization. The sponsor confirmed the concern, the judge upheld it as a valid Medium, and the fix wrapped the aliasing arithmetic in an unchecked block in a future 0.8.0 branch.

The Graphcode4renaAug 7, 2026Open

All reports in this group

Vulnerability classes seen in this protocol type

Reentrancy Oracle manipulation Flash loan attack Access control Integer overflow / underflow Signature replay Front-running / MEV Bridge exploit Logic error Governance attack

Related protocol type pages

DEX Lending Oracle NFT Stablecoin Other protocols