Fuzzing Cross-Chain Vulnerabilities with BridgeFuzz

Abstract

Cross-chain bridges are critical for decentralized finance (DeFi) to enable asset interoperability across heterogeneous blockchains. They are based on a complex hybrid architecture that involves on-chain contracts and off-chain relayers. In the recent past, several major attacks exploited vulnerabilities in cross-chain bridges. However, existing analysis tools have limited detection effectiveness as they focus on individual contracts and do not capture the complex interaction chain in cross-chain bridges. In this paper, we present BridgeFuzz, the first fuzzing framework for cross-chain bridge developers capable of detecting vulnerabilities such as balance mismatches, protocol errors, and off-chain denial-of-service bugs. BridgeFuzz is the first step towards bridging the gap between smart contract vulnerability research and the holistic vulnerability analysis of cross-chain bridges.