Breaking Bridges - An Incomplete Sampler of Bridges Hacks
summary
Catalog of past bridge failures with concrete failure modes and attack steps: LiFi aggregator call data exploit lets a user-supplied target and calldata instruct a bridge to transfer its own ERC‑20s; AnySwap / Multichain permit fallback abuse uses user-deployed token contracts without reverting permit to siphon prior approvals; Nomad init zero allowing fake messages plus an upgrade bug lets anyone process unproven messages and triggers thousands of MEV-driven withdrawals; client bugs on Optimism enable self‑destruct double‑minting of L2 ether and consensus/fraud‑proof issues enable up to seven‑day reorg double spends; Ronin shows simple multisig key compromise.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:39Side Effects
- 3:43Multichain (formerly AnySwap)
- 6:48Nomad - BEFORE
- 7:10Nomad - AFTER
- 7:40Nomad - the upgrade
- 8:13Nomad - decentralized robbery
- 9:15Nomad - summary
- 9:35Nomad - BONUS
- 12:51Optimism: Time Travel
- 16:36Arbitrum (pre-prod) - bridges break assumptions too
- 19:26Ronin - summary
related talks
11mCommon Vulnerabilities in Bridges
25mCommSec D2 - Smart Contract (In)Security
43mOutsmarting Smart Contracts
15mExamining Bridging Behavior Using On-Chain Analytics
38mUnifying Blockchains: Innovations for Seamless Interoperability
51mA Deal with the Devil: Breaking Smart Contracts
28mCross-Contract Ricochet Attacks & Off-Chain-On-Chain Manipulation of Billion Dollar NFT Collections
24mTrust-less and Efficient Bridges via Random Sampling