Arbalest Bridge

_verifySignatures loops over the submitted signatures, recovers each signer, checks validatorSet.isValidator(signer) and increments a counter. It never checks that signers are distinct.

A relayer can submit the same valid signature threshold times. A single validator key — or a single signature leaked from a legitimate message to the same digest — therefore satisfies a threshold intended to require several independent parties.

Unbacked minting of wrapped tokens on every destination chain, or release of the entire vault on the return path, limited only by the rate limiter.

Require signatures sorted by strictly increasing signer address and revert when signer <= lastSigner. This rejects duplicates in O(n) without extra storage.

Strict ordering enforced; fuzz tests with duplicated and permuted signatures added. INV-02 holds.

The digest is keccak256(abi.encode(nonce, sourceChainId, token, amount, recipient)). It does not include the destination chain ID or the receiver contract address.

The same validator set secures both Base and Arbitrum, and nonces are tracked per receiver. A message signed for Base is therefore also valid on Arbitrum, and on any future receiver deployment that shares the validator set.

Every legitimate transfer can be replayed once per additional destination, creating unbacked wrapped supply.

Sign an EIP-712 typed struct whose domain includes the destination chain ID and the receiver contract, and include the destination chain ID in the message itself.

EIP-712 domain separation adopted; validator software updated to sign typed data. INV-01 holds.

updateValidators(newSet, threshold, sigs) accepts a new set signed by the current set. The signed payload contains the new members and threshold but no epoch or previous-set hash.

If the set rotates from A to B and later back towards a configuration signed earlier, any previously signed update remains valid whenever its signers are again a threshold of the current set. In particular, an update signed by set A that installs a set including compromised keys can be replayed if A is ever restored.

Takeover of the validator set, after which all bridge funds are at risk within rate limits.

Include a monotonically increasing epoch and the hash of the current set in the signed payload, and reject updates for any epoch other than currentEpoch + 1.

Epoch added to the signed payload. The previous-set hash is not yet included, and the receivers on Base and Arbitrum do not yet read the epoch; re-review pending.

lock(token, amount) calls safeTransferFrom(user, vault, amount) and records amount in the outbound message. Tokens that charge a fee on transfer deliver less than amount, so the wrapped side mints more than the vault received.

The gateway has no allowlist preventing such tokens from being bridged, and some tokens can switch fee behaviour on after listing.

Gradual insolvency of the vault for affected tokens; INV-03 fails.

Measure the vault balance before and after the transfer and bridge the delta, or restrict the gateway to an allowlist of tokens with standard transfer semantics.

Open. The team plans a token allowlist rather than balance-delta accounting; not yet implemented at the remediation commit.

The limiter resets its counter at fixed window boundaries. An attacker with mint capability can use the full cap just before a boundary and again just after, moving twice the intended amount in a short period.

Worst-case loss during an incident is up to twice the configured cap before responders can pause.

Use a rolling window or a token-bucket that refills continuously.

Acknowledged. Caps were halved so the worst-case two-window loss matches the original single-window budget.

Signatures are recovered with raw ecrecover, which accepts both s and n − s. Each valid signature therefore has a second valid encoding. Combined with AB-01 this widened the duplicate-signature issue; on its own it affects anything that keys on signature bytes.

Low in isolation; removes a defence-in-depth layer.

Use OpenZeppelin ECDSA.recover, which rejects high-s values.

Switched to ECDSA.recover.

The gateway’s custom pause flag changes without an event, so monitoring cannot alert on pause state changes on any chain.

Reduced observability during incidents.

Emit events for pause state changes or inherit OpenZeppelin Pausable.

Inherits Pausable; events emitted.

A successful updateValidators call replaces the active set in the same transaction. There is no delay during which watchers can observe the pending set or a guardian can cancel it.

If a threshold of keys is compromised, the attacker can rotate to a set of their own keys and begin minting in the next block, leaving the honest validators no recourse.

Permanent loss of control over the bridge with no window to intervene.

Queue validator-set updates with an activation delay (for example 48 hours) and allow a separate guardian role to cancel a pending update.

Open. A queued-update design is under discussion with the team.