Bridge tracks nonce-consumed mapping
A cross-chain & bridge factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the bridge inbox maintains a nonce-consumed mapping that permanently records processed message nonces and rejects any attempt to process the same nonce twice. Static analysis of the bridge inbox contract is the assessment method. This factor applies only to bridge-touching protocols; non-bridge protocols show this factor as N/A.
**Why it matters** Without replay protection, a valid bridge message — once processed — can be submitted again to trigger a second, unbacked release of tokens on the destination chain. This is distinct from the cross-chain replay addressed by RD-F-152: same-chain replay exploits the fact that the bridge contract does not remember which messages it has already executed. The T-01 evidence base links same-chain replay to approximately 2 protocols in the hack database. A consumed-nonce mapping (or equivalent commitment scheme such as a Merkle leaf membership proof with leaf-burn) is the standard mitigation and is considered table-stakes for any bridge operating at material TVL.
**Green / Yellow / Red** Green is scored when the bridge implements a nonce-consumed mapping (or equivalent one-use commitment scheme) that is enforced before processing any message. Yellow is scored when replay protection exists for some message types but not others, or when the nonce space is insufficiently large. Red is scored when no replay protection mechanism is present and previously processed messages can be re-submitted.
**Common gray cases** Gray is applied when the bridge uses an off-chain sequencer or relayer that maintains replay protection externally and the on-chain component cannot be independently assessed.
**Notable historical examples** No cross-hacked incidents are currently linked in the database for this factor.
Measurement what to look for #
Determine whether the bridge inbox maintains a nonce-consumed mapping and rejects replay of used nonces.