Bridge-auditing benchmark exposes uneven cross-component verification reasoning

A bridge auditor must establish where a cross-chain message is authenticated and how the resulting authority reaches execution. The CVV study finds that language models can miss flaws when that flow spans unavailable components, while also flagging legitimate applications that delegate their checks upstream. The experiments measure auditing performance; they do not demonstrate an AI-driven bridge exploit.

The authors began with 588 audit reports from 36 projects and screened 6,069 findings, identifying 1,482 cross-chain verification vulnerabilities. Their taxonomy groups 11 patterns into message authenticity, execution integrity, replay and freshness, verification soundness, and trust management. Recovering an auditable code version then reduced the retained dataset to 830 instances from 209 reports and 27 projects, mapped to 786 source files. The initial survey and retained evaluation material therefore have different denominators.

The evaluation asks each model to identify patterns in an audit-scoped code package using a common taxonomy and output schema. The unit is a report-level multi-label decision. The constant baseline predicts all 11 patterns for every report, which produces a Macro-F1 of 29.3% because pattern frequencies differ. Composer-2.5 scores 51.2%, GPT-5.5 33.8%, DeepSeek-V4-Pro 25.3% and Opus-4.8 20.7%. Macro-F1 averages the pattern-level F1 values; it is not the percentage of the 830 findings detected or the probability that a deployed bridge is safe.

The error analysis explains why more confident local code review is insufficient. An omitted gateway can conceal the verification path needed to recognize a vulnerability. Conversely, a visible application may omit a local source-chain check because the gateway already authenticated the message. The model must distinguish missing evidence from a missing control. Separate errors involve protocol-specific signature, replay and trust-state semantics even when relevant code is present.

The replication README is publicly readable and describes the source packages, finding labels, prompts and model results. This review inspected that documentation and the visible inventory, but did not rerun the models or recompute the scores. The paper's comparison with conventional tools is a mapping of documented coverage, not a complete runtime benchmark. Public-report selection, accessible code, labeling decisions and changing model services limit generalization, especially to entirely clean bridge projects or different prompting and retrieval setups.