Cross-chain bridge unverified mint pattern
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when cross-chain activity is detected that is consistent with an unverified mint on the destination chain — specifically, when a large mint event on the destination chain occurs without a corresponding verifiable deposit or lock event on the source chain within the expected message-delivery latency window. The signal requires cross-chain indexing to correlate source-chain deposit events with destination-chain mint events. Category 6 context: the "mint without corresponding lock" pattern is the fundamental exploit signature of bridge replay and validation-bypass attacks.
**Why it matters** Nomad Bridge ($190M, 2022) — the bytes32(0) valid-root exploit — enabled any address to mint tokens on the destination chain without any source-chain deposit, once the bug was discovered. Wormhole ($320M, 2022) involved a signature-verification bypass that enabled fabricated guardian messages to trigger mints. The Meter Passport bridge exploit and Harmony Bridge incident both show variants of this pattern. Cross-chain indexing to detect mint-without-lock events is technically complex (PH curation) but provides the only real-time detection window for bridge validation exploits. Without this signal, bridge attacks are invisible until TVL is already drained.
**Green / Yellow / Red** Green is the baseline when all destination-chain mint events have corresponding verifiable source-chain deposit events within the expected delivery window. Yellow fires when a mint event arrives within the expected window but the source-chain confirmation count is below the safe threshold (e.g., four blocks on Ethereum for large amounts). Red fires when a mint event on the destination chain has no corresponding source-chain deposit within five times the expected delivery window — indicating either a validation bypass or a proof-fabrication attack.
**Common gray cases** Gray applies when the bridge uses a zero-knowledge proof system where proof verification on-chain does not correspond one-to-one with indexable source-chain events, or when source-chain monitoring coverage is incomplete for the specific chain pair.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect cross-chain activity consistent with an unverified mint on the destination chain (deposit on source without corresponding verified proof on dest).