george0papasotiriou/cve-2026-23003-cross-chain-bridge-message-forging-via-missing-origin-chain-idCross-chain bridge PoC for CVE-2026-23003: demonstrates message forging via missing origin chain ID using vulnerable Solidity contract and Python exploit.
// Bridge.sol - Vulnerable bridge contract
contract Bridge {
mapping(bytes32 => bool) public processed;
event Deposited(address from, address to, uint256 amount, uint256 chainId);
function deposit(address to, uint256 amount, uint256 chainId) external payable {
emit Deposited(msg.sender, to, amount, chainId);
}
function withdraw(bytes memory proof, address from, address to, uint256 amount, uint256 chainId) external {
// Verify proof signature (simulated)
require(verifyProof(proof, from, to, amount, chainId), "Invalid proof");
// Missing check: did this message originate from chainId?
// An attacker can replay a Deposit event from another chain where they are the 'from'
payable(to).transfer(amount);
}
function verifyProof(...) internal pure returns (bool) { return true; } // simplified
}
A cross‑chain bridge validates message proofs but does not check the chain ID of the source chain. An attacker can replay a deposit event from a low‑security chain onto the main bridge, effectively minting tokens out of thin air.
withdraw function accepts a chainId parameter from the proof but does not verify it matches the expected source chain; the proof only signs the message, not the chain context.Deploy the vulnerable contract, simulate a deposit on a test chain, then call withdraw on the main chain with the same proof – the tokens are released.
git clone https://github.com/yourorg/CVE-2026-23003.git
cd CVE-2026-23003
# Deploy with Hardhat/Foundry and test