Bridge protocol vulnerabilities in disclosed bug bounty reports
The highest-value target class in crypto: concentrated custody plus verification of events from a chain the verifier cannot execute.
- Reports indexed
- 92
- Total paid
- $4.5M
- Critical
- 2
- Largest payout
- $2.5M
Bridges have produced the largest losses in the industry's history, and the disclosed reports show why: they combine a vault holding pooled deposits with a verification layer that must judge, off its own chain, whether a distant event actually happened.
Findings split cleanly into verification failures — bad proof handling, weak or miscounted signature thresholds, missing source-chain binding — and custody failures, where the mint or release path is reachable without the verification having succeeded.
Payout sizes in this class are consistently the largest on the platform, which makes the payout comparables view particularly useful for bridge submissions.
What reviewers look for
- Proofs verified against attacker-influenced roots
- Signature thresholds without signer deduplication
- Missing source-chain and source-contract binding on messages
- Mint paths reachable without a corresponding verified lock
- Replay protection keyed on attacker-chosen values
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Cross-chain bridge signature replay allows infinite mint
A signature validation vulnerability in a cross-chain bridge protocol allowed valid guardian attestations to be replayed across different destination chains. The signed message digest omitted essential domain parameters like the target chain ID and global emitter sequence, allowing an attacker to reuse a single legitimate withdrawal signature on multiple bridge deployments. Consequently, an attacker could mint unlimited wrapped assets across various target chains without providing additional collateral on the source chain.
Bridge withdrawal proof accepts empty Merkle path
A flawed proof verification mechanism in an L2 canonical bridge contract permitted withdrawal validation using an empty Merkle proof array. When no proof elements were supplied, the verification function failed to iterate and directly compared the unhashed withdrawal leaf against the target root. By matching a fake withdrawal leaf payload with a valid historical or relayable state root, an attacker could forge arbitrary withdrawal events and drain escrowed funds from the bridge.
Cosmos SDK module allows unauthorized state migration via missing ante handler check
A logic flaw in a Cosmos SDK module's state migration handler allowed unauthorized signers to execute privileged state updates. The message authority check relied on a helper function that returned true when the authority field was empty, and the message route was incorrectly exposed as a standard transaction rather than being restricted to governance. An attacker could issue state updates with an empty authority field to inject malicious counterparties into the IBC channel allowlist, enabling the execution and processing of forged cross-chain transactions.
Olas: Arbitrary tokens and data can be bridged to `GnosisTargetDispenserL2` to manipulate staking incentives
The GnosisTargetDispenserL2 contract in the Olas protocol is vulnerable to unauthorized state manipulation because its cross-chain message handler fails to verify the sender of incoming transactions. An attacker can transmit arbitrary tokens and malicious staking data via the Omnibridge to the L2 contract. Because the contract lacks origin authentication, it processes this fraudulent payload as legitimate data, allowing the attacker to manipulate staking incentive distributions and potentially misappropriate withheld funds.
Olas: Users will lose all ETH sent as `cost` parameter in transactions to and from Optimism
The Olas protocol's OptimismDepositProcessorL1 contract mistakenly attempts to cover message delivery fees by forwarding ETH as a value to the Optimism messaging bridge. This design is incompatible with the Optimism protocol, which covers message delivery through gas consumption on the source chain rather than explicit ETH transfers to the messenger. As a result, any funds users provide to cover these expected costs are erroneously sent to the L2 destination contract, where they remain permanently locked and inaccessible to the user.
Olas: Attacker can make claimed staking incentives irredeemable on Gnosis Chain
The Olas staking incentive bridge on Gnosis Chain is vulnerable to a denial-of-service attack due to improper validation of user-supplied gas limits for cross-chain messages. By specifying an intentionally low gas limit during the claim process, an attacker can cause the L2 execution of the bridge message to fail with an out-of-gas error. Since the Gnosis Arbitrary Message Bridge does not natively support message replays, this renders the claimed incentives permanently irredeemable without costly, off-chain governance intervention.
All reports in this group
- Olas: Refunds for unconsumed gas will be lost due to incorrect refund chain IDBridge exploit$0
- Olas: Non-normalized amounts sent via Wormhole lead to failure to redeem incentivesInteger overflow/underflow$0
- Olas: Loss of incentives if total weight in an epoch is zeroBridge exploit$0
- Olas: Attacker can cancel claimed staking incentives on ArbitrumAccess control$0
- Arbitrum Foundation: Inconsistent sequencer unexpected delay in DelayBuffer may harm users calling `forceInclusion()`Bridge exploit$0
- Renzo: Potential arbitrage opportunity in the `xRenzoDeposit` L2 contractFront-running / MEV$0
- Renzo: The amount of `xezETH` in circulation will not represent the amount of `ezETH` tokens 1:1Oracle manipulation$0
- Renzo: Fixed hearbeat used for price validation is too stale for some tokensOracle manipulation$0
- Renzo: Fetched price from the oracle is not stored in `xRenzoDeposit`Reentrancy$0
- Renzo: Incorrect exchange rate provided to Balancer poolsOracle manipulation$0
- Renzo: Not handling the failure of cross chain messagingReentrancy$0
- Taiko: Invocation delays are not honoured when protocol unpausesFront-running / MEV$0
- Taiko: A recalled ERC20 bridge transfer can lock tokens in the bridgeBridge exploit$0
- Taiko: Bridge watcher can forge arbitrary message and drain bridgeAccess control$0
- Taiko: Bridged tokens would be lost if sender and receiver are contracts that don't implement fallback/receiveBridge exploit$0
- Taiko: Malicious caller of `processMessage()` can pocket the fee while forcing `excessivelySafeCall()` to failBridge exploit$0
- Decent: Users can use the protocol freely without paying any fees by calling the `DecentEthRouter::bridgeWithPayload()` function directly.Access control$0
- Decent: Permanent loss of tokens if swap data gets outdatedBridge exploit$0
- Decent: Potential loss of capital due to fixed fee calculationsBridge exploit$0
- Decent: Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.Access control$0
- Decent: Due to missing checks on minimum gas passed through LayerZero, executions can fail on the destination chainBridge exploit$0
- Decent: DecentEthRouter.sol#_bridgeWithPayload() - Any refunded ETH (native token) will be refunded to the DecentBridgeAdapter, making them stuckBridge exploit$0
- Decent: When `DecentBridgeExecutor.execute` fails, funds will be sent to a random addressAccess control$0
- zkSync: `Mailbox.requestL2Transaction()` checks the deposit limit of `msg.sender` (`L1WethBridge`) instead of the real depositor of weth from L1, as a result, after certain time, nobody will be able to deposit weth anymore from L1Bridge exploit$0
- Ethereum Credit Guild: Auction manipulation by block stuffing and reverting on ERC-777 hooksAccess control$0
- Olas: LP rewards in `liquidity_lockbox` can be arbitragedFlash loan attack$0
- Olas: Withdraw amount returned by `getLiquidityAmountsAndPositions` may be incorrectBridge exploit$0
- Maia DAO: Incorrect source address decoding in RootBridgeAgent and BranchBridgeAgent's `_requiresEndpoint` breaks LayerZero communicationReentrancy$0
- Maia DAO: If `RootBridgeAgent.lzReceiveNonBlocking` reverts internally, the native token sent by relayer to RootBridgeAgent is left in RootBridgeAgentBridge exploit$0
- Maia DAO: if the Virtual Account's owner is a Contract Account (multisig wallet), attackers can gain control of the Virtual Accounts by gaining control of the same owner's address in a different chainAccess control$0
- Maia DAO: Incorrect flag results to `_hasFallbackToggled` always set to false on `createMultipleSettlement`.Bridge exploit$0
- Maia DAO: `addGlobalToken()` `localAdress` could be overwrittenBridge exploit$0
- Maia DAO: No deposit cross-chain calls/communication can still originate from a removed branch bridge agentBridge exploit$0
- Maia DAO: When using BaseBranchRouter as a router on the 'Arbitrum' branch, we are unable to invoke the 'callOutAndBridge' function.Bridge exploit$0
- Maia DAO: Message channels can be blocked resulting in DoSBridge exploit$0
- Maia DAO: `ArbitrumBranchBridgeAgent::_performFallbackCall` function does not refund users their excess native gas depositBridge exploit$0
- Maia DAO: `BaseBranchRouter._transferAndApproveToken` may revert in some casesBridge exploit$0
- Maia DAO: Depositors could lose all their deposited tokens (including the hTokens) if their address is blacklisted in one of all the deposited underlyingTokensBridge exploit$0
- Maia DAO: Redeeming a Settlement won't work for unsigned messages when the communicating dApps have different addresses on the different chainsBridge exploit$0
- Tapioca DAO: TOFT `exerciseOption` can be used to steal all underlying erc20 tokensGovernance attack$0
- Tapioca DAO: All assets of (m)TapiocaOFT can be stealed by depositing to strategy cross chain call with 1 amount but maximum shares possibleBridge exploit$0
- Tapioca DAO: `twTAP.participate()` can be permanently frozen due to lack of access control on host-chain-only operationsAccess control$0
- Tapioca DAO: `_sendToken` implementation in `Balancer.sol` is wrong which will make the underlying erc20 be send to a random address and lostBridge exploit$0
- Tapioca DAO: Exercise option cross chain message in the (m)TapiocaOFT will always revert in the destination, losing debited funds in the source chainGovernance attack$0
- Tapioca DAO: Refund mechanism for failed cross-chain transactions does not workBridge exploit$0
- Tapioca DAO: `BaseTOFT.sol`: `retrieveFromStrategy` can be used to manipulate other user's positions due to absent approval checkFront-running / MEV$0
- Tapioca DAO: `BaseTOFT.sol`: `removeCollateral` can be used to manipulate other user's positions and steal tokens due to absent approval checkFront-running / MEV$0
- Tapioca DAO: Magnetar contract has no approval checkingOracle manipulation$0
- Tapioca DAO: Attacker can pass duplicated reward token addresses to steal the reward of contract `twTAP.sol`Bridge exploit$0
- Tapioca DAO: `multiHopSellCollateral()` will fail due to call on an invalid market address causing bridged collateral to be locked upBridge exploit$0
- Tapioca DAO: A user with a TapiocaOFT allowance >0 could steal all the underlying ERC20 tokens of the ownerGovernance attack$0
- Tapioca DAO: Anybody can buy collateral on behalf of other users without having any allowance using the multiHopBuyCollateral()Oracle manipulation$0
- Tapioca DAO: `twTAP.sol`: Reward tokens stored in index 0 can be stolenGovernance attack$0
- Centrifuge: `onlyCentrifugeChainOrigin()` can't require `msg.sender` equal `axelarGateway`Bridge exploit$0
- Maia DAO Ecosystem: On Ulysses omnichain - `RetrieveDeposit` might never be able to trigger the `Fallback` functionBridge exploit$0
- Maia DAO Ecosystem: `RootBridgeAgent->CheckParamsLib#checkParams` does not check that `_dParams.token` is underlying of `_dParams.hToken`Bridge exploit$0
- Maia DAO Ecosystem: An attacker can steal Accumulated Awards from `RootBridgeAgent` by abusing `retrySettlement()`Bridge exploit$0
- Maia DAO Ecosystem: The user is enforced to overpay for the `fallback` gas when calling `retryDeposit`Bridge exploit$0
- Maia DAO Ecosystem: Cross-chain messaging via `Anycall` will failBridge exploit$0
- Maia DAO Ecosystem: A user can call `callOutSigned` without paying for gas by reentering `anyExecute` with Virtual AccountReentrancy$0
- Maia DAO Ecosystem: Incorrectly reading the offset from the received data parameter to get the `depositNonce` in the `BranchBridgeAgent::anyFallback()` functionBridge exploit$0
- Maia DAO Ecosystem: DoS of `RootBridgeAgent` due to missing negation of return values for `UniswapV3Pool.swap()`Integer overflow/underflow$0
- Maia DAO Ecosystem: `BranchBridgeAgent._normalizeDecimalsMultiple` will always revert because of the lack of allocating memoryBridge exploit$0
- Maia DAO Ecosystem: Inconsistencies in reading the encoded parameters received in the `_sParams` argument in `BranchBridgeAgent::clearTokens()`Bridge exploit$0
- Maia DAO Ecosystem: Use of `slot0` to get `sqrtPriceLimitX96` can lead to price manipulation.Oracle manipulation$0
- Maia DAO Ecosystem: Multiple issues with decimal scaling will cause incorrect accounting of hTokens and underlying tokensBridge exploit$0
- Maia DAO Ecosystem: Depositing gas through `depositGasAnycallConfig` should not withdraw the `nativeToken`Bridge exploit$0
- Maia DAO Ecosystem: Accessing the incorrect offset to get the nonce when a flag is 0x06 in `RootBridgeAgent::anyExecute()` will lead to marked as executed incorrect nonces and could potentially cause a DoSBridge exploit$0
- Maia DAO Ecosystem: Ulysses omnichain - `addbridgeagentfactory` in `rootPort` is not functionalAccess control$0
- Maia DAO Ecosystem: `MIN_FALLBACK_RESERVE` (in `BranchBridgeAgent`) doesn't consider the actual gas consumption in ``AnyCall`` contracts, which lets the user underpay the actual cost when replenishing the execution budgetAccess control$0
- Maia DAO Ecosystem: Incorrect accounting logic for `fallback` gas will lead to insolvencyBridge exploit$0
- Maia DAO Ecosystem: When the `anyExecute` call is made to `RootBridgeAgent` with a `depositNonce` that has been recorded in `executionHistory`, `initialGas` and `userFeeInfo` will not be updated, which would affect the next caller of `retrySettlement`.Bridge exploit$0
- Maia DAO Ecosystem: `RootBridgeAgent.redeemSettlement` can be front-run using `RootBridgeAgent.retrySettlement`, causing redeem to DoSAccess control$0
- Maia DAO Ecosystem: Replenishing gas is missing in `_payFallbackGas` of `RootBridgeAgent`Bridge exploit$0
- Maia DAO Ecosystem: Due to inadequate checks, an adversary can call `BranchBridgeAgent#retrieveDeposit` with an invalid `_depositNonce`, which would lead to a loss of other users' deposits.Bridge exploit$0
- Maia DAO Ecosystem: A malicious user can set any contract as a local `hToken` for an underlying token since there is no access control for `_addLocalToken`Reentrancy$0
- Maia DAO Ecosystem: Lack of a return value handing in `ArbitrumBranchBridgeAgent._performCall()` could cause users' deposit to be locked in contractBridge exploit$0
- Maia DAO Ecosystem: An attacker can redeposit gas after `forceRevert()` to freeze all deposited gas budget of `Root Bridge Agent`Reentrancy$0
- Maia DAO Ecosystem: Missing the unwrapping of native token in `RootBridgeAgent.sweep()` causes fees to be stuckBridge exploit$0
- Maia DAO Ecosystem: Multiple issues with `retrySettlement()` and `retrieveDeposit()` will cause loss of users' bridging depositsBridge exploit$0
- Maia DAO Ecosystem: Overpaying remaining gas to the user for failing `anyExecute` call due to an incorrect gas unit calculation in `BranchBridgeAgent`Access control$0
- Maia DAO Ecosystem: Reentrancy attack possible on `RootBridgeAgent.retrySettlement()` with missing access control for `RootBridgeAgentFactory.createBridgeAgent()`Reentrancy$0
- Maia DAO Ecosystem: The difference between `gasLeft` and `gasAfterTransfer` is greater than `TRANSFER_OVERHEAD`, causing `anyExecute` to always failAccess control$0
- Maia DAO Ecosystem: An attacker can mint an arbitrary amount of `hToken` on `RootChain`Access control$0
- Maia DAO Ecosystem: User may underpay for the remote call `ExecutionGas` on the root chainBridge exploit$0
- Biconomy: Cross-Chain Signature Replay AttackSignature replay$0