Skip to content
critical Bridge / Cross-Chain SWC-115 CWE-345

Cross-Chain Source / Sender Not Verified

SAFE-0246 Bridge / Cross-Chain Checked automatically by the scanner
1

What goes wrong

A message handler (LayerZero lzReceive / CCIP _ccipReceive / custom relayer) does not verify the source chain and the remote sender address against a trusted-remote allowlist. Anyone can deliver a forged message and trigger privileged mint/release logic.

2

The vulnerable pattern

proof of concept — how it is exploited
// lzReceive(srcChain, srcAddr, payload) mints from payload without
// checking srcAddr. Attacker calls it directly with a forged payload
// -> unlimited cross-chain mint.
3

How to fix it

the pattern that is safe
require(msg.sender == address(endpoint), "not endpoint");
require(srcChain == TRUSTED_CHAIN && keccak256(srcAddr) == keccak256(TRUSTED_REMOTE), "bad source");
◆
Enforce trusted-remote checks on every inbound message.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$586M · 2022 BNB Chain Token Hub Input validation · 2022 $326M · 2022 Wormhole Input validation · 2022 $197M · 2023 Euler Finance Input validation · 2023 $190M · 2022 Nomad Bridge Input validation · 2022
5

Related vulnerabilities in Bridge / Cross-Chain

SAFE-0063Bridge Message Forgery / Insufficient Proof Verification critical · Bridge / Cross-Chain SAFE-0064Cross-Domain Authentication Failure critical · Bridge / Cross-Chain SAFE-0245Bridge Message Replay (No Processed-Nonce Map) high · Bridge / Cross-Chain SAFE-0247chainId Not Bound in Cross-Chain Payload medium · Bridge / Cross-Chain SAFE-0248Cross-Chain Message Ordering Not Enforced medium · Bridge / Cross-Chain
← PreviousBridge Message Replay (No Processed-Nonce Map)
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0246 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs