cross-chain-security

Cross-Chain Security

Message Replay Across Chains

Signatures and messages valid on one chain can be replayed on another if the chain ID isn't included.

// VULNERABLE: no chain ID in domain separator
bytes32 DOMAIN_SEPARATOR = keccak256(abi.encode(
    keccak256("EIP712Domain(string name,address verifyingContract)"),
    keccak256("MyProtocol"),
    address(this)
));

// FIXED: include chain ID
bytes32 DOMAIN_SEPARATOR = keccak256(abi.encode(
    keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
    keccak256("MyProtocol"),
    keccak256("1"),
    block.chainid,
    address(this)
));

Recomputing Domain Separator on Fork

If a chain forks, block.chainid changes but a cached domain separator doesn't.

uint256 private immutable _CACHED_CHAIN_ID;
bytes32 private immutable _CACHED_DOMAIN_SEPARATOR;

constructor() {
    _CACHED_CHAIN_ID = block.chainid;
    _CACHED_DOMAIN_SEPARATOR = _computeDomainSeparator();
}

function DOMAIN_SEPARATOR() public view returns (bytes32) {
    if (block.chainid == _CACHED_CHAIN_ID) {
        return _CACHED_DOMAIN_SEPARATOR;
    }
    return _computeDomainSeparator();
}

Bridge Verification

Never trust bridge messages blindly. Verify the source chain, sender, and message format.

interface ICrossDomainMessenger {
    function xDomainMessageSender() external view returns (address);
}

contract L2Vault {
    address public immutable L1_BRIDGE;
    address public immutable MESSENGER;

    error NotFromBridge();
    error InvalidL1Sender();

    modifier onlyBridge() {
        if (msg.sender != MESSENGER) revert NotFromBridge();
        if (ICrossDomainMessenger(MESSENGER).xDomainMessageSender() != L1_BRIDGE) {
            revert InvalidL1Sender();
        }
        _;
    }

    function handleMessage(bytes calldata data) external onlyBridge {
        // safe to process — verified from L1_BRIDGE via canonical messenger
    }
}

Finality Assumptions