IntentFuzz finds vulnerabilities in cross-chain blockchain bridges
IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges
Cryptography and Security
Summary
Moving digital value between different blockchains uses special tools called cross-chain bridges. Some bridges rely on users stating their goals, and a solver makes sure these goals are met safely. Existing tools miss some risks because they either look for known problems or need experts to add specific checks. The authors made IntentFuzz, a tool that understands how these bridges are meant to work, then tests where safety rules might break. It caught many real problems in popular bridge code, showing it can help make blockchain transfers safer.
What this means in practice
- •For blockchain developers: Automatically test cross-chain bridge code to detect safety rule violations without writing custom checks for each protocol.
- •For security audit teams: Find hard-to-spot safety bugs in deployed blockchain bridge contracts using protocol-aware fuzzing enhanced by large language models.
Authors
André Augusto, Christof Ferreira Torres, André Vasconcelos, Miguel Correia
Abstract
Cross-chain bridges move value between blockchains. Intent-based bridges are a variant where a solver fulfills a user's declared outcome and an off-chain settlement layer later reconciles the fill against the deposit. Existing smart-contract fuzzers and static analyzers only flag known-bad code patterns or require protocol-specific hand-written assertions. This work formalizes a taxonomy separating invariant violations, safety properties a contract must enforce locally, from settlement exposures legitimately delegated to the off-chain settlement layer, and proposes IntentFuzz: a protocol-aware fuzzer that recovers a bridge's intent structure and deposit/fill function roles directly from unannotated Solidity source, then synthesizes multi-step fuzz sequences using an LLM-based fallback to help build call arguments. IntentFuzz recovers the correct intent structure in 9/9 benchmark protocols and classifies deposit and fill functions with 100% recall and 82% combined precision; across a corpus of 77 manually labeled contracts, it reaches 79.5% bridge-classification precision and 97.2% recall, and among confirmed bridges, struct selection reaches 88.6% precision and recall while deposit and fill classification each reach 100% recall. On 23 planted-bug mutants, IntentFuzz attains 100% recall and 100% precision, executing 273 templates (507 transactions in a median of 14ms per template). Across 24 real-world deployments, it confirms 17 genuine invariant violations under heuristic-only input generation, rising to 22 with its LLM-assisted tier enabled, spanning eight vulnerable GitHub repositories, each finding reproducible against public, deployed bytecode.