Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Cross-chain bridge validator-set bypass → mint wrapped tokens

Bridge's signature-set check is off-by-one (Nomad-class) or accepts a zero address (Ronin-class). Mint wrapped tokens on the destination chain without locking on the source.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target operates a cross-chain bridge with a multi-sig / validator set. Bridge contract has a known class of validator-check flaw (initialization, threshold, signer recovery).

§ Steps

  1. 01
    Bridge to liquid assetExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Mint wrapped tokens on destination chainInitial Access
    T1078— Valid Accounts
  3. 03
    Tumble through privacy poolDefense Evasion
    T1027— Obfuscated Files or Information
  4. 04
    Audit bridge validator-set logicReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  5. 05
    Craft fake / replayed proofImpact
    W3-BRIDGE-EXPLOIT— Cross-Chain Bridge Exploit
  6. 06
    Identify validator-check flawImpact
    W3-BRIDGE-EXPLOIT— Cross-Chain Bridge Exploit

§ References

§ Frequently asked

What is the "Cross-chain bridge validator-set bypass → mint wrapped tokens" attack path?
Bridge's signature-set check is off-by-one (Nomad-class) or accepts a zero address (Ronin-class). Mint wrapped tokens on the destination chain without locking on the source. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bridge to liquid asset (T1041) — a exfiltration primitive. Assumed environment: target operates a cross-chain bridge with a multi-sig / validator set.
What is the final impact of this kill-chain?
The final step lands on Identify validator-check flaw (W3-BRIDGE-EXPLOIT), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers