Skip to content
critical Bridge / Cross-Chain No SWC entry CWE-345

Bridge Message Forgery / Insufficient Proof Verification

SAFE-0063 Bridge / Cross-Chain Checked automatically by the scanner
1

What goes wrong

A bridge mints or releases funds based on a cross-chain message whose validity (signatures, Merkle proof, guardian set) is improperly verified, letting an attacker forge deposit proofs and withdraw on the destination chain.

2

How to fix it

the pattern that is safe
function release(bytes calldata m, bytes[] calldata sigs) external {
    bytes32 h = keccak256(m);
    require(!processed[h], "replayed");
    require(_quorumValid(h, sigs), "insufficient sigs");
    processed[h] = true; _payout(decode(m));
}
Wormhole/Nomad/Ronin class. Verify proofs fully + dedup messages.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0063 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs