Understanding Verification Vulnerabilities in Cross-chain Bridges: An Empirical Study

Evidence record

Primary preprint inspected in full-text HTML. It reports audit-finding screening, a code-mapped CVV dataset, a report-level four-model detection evaluation, prevalence-aware baselines and qualitative error analysis. The results are author-reported and were not independently reproduced.

Read the original source ↗

Claim-level citations (7)

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: The authors collected 588 public audit reports for 36 bridge projects, screened 6,069 findings and retained 1,482 cross-chain verification vulnerabilities for an 11-pattern taxonomy grouped into five categories.

  Sections 3.1-3.3; Table 1 screening counts; Table 2 taxonomy counts.

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: In the reported evaluation, Macro-F1 is 51.2% for Composer-2.5, 33.8% for GPT-5.5, 25.3% for DeepSeek-V4-Pro and 20.7% for Opus-4.8. Only Composer-2.5 and GPT-5.5 exceed the 29.3% all-pattern baseline.

  Table 8 Macro Avg. F1 columns; Table 9(a), model-level comparison; Section 5.2.

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: The authors identify missing cross-component context and insufficient protocol-specific semantics among false-negative causes; they attribute false positives to surface-level pattern matching and misjudged boundaries where upstream components already perform checks.

  Section 5.3, False negatives and False positives, Findings 7-9.

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: After recovering and manually checking audited code versions, the retained dataset contains 830 vulnerability instances from 209 audit reports across 27 bridge projects, mapped to 786 source files. GPT-5.5 was used to extract version clues, which the authors say were manually verified.

  Sections 4.1-4.2 and Table 3.

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: The conventional-tool comparison maps published documentation and analysis semantics to CVV patterns. It is not a runtime head-to-head execution of all listed tools against every retained finding.

  Section 5.1, CVV pattern coverage, and Table 7.

• supportsBridge-auditing benchmark exposes uneven cross-component verification reasoning: The LLM experiment uses audit-report-level multi-label decisions over 11 CVV patterns with a common taxonomy-guided prompt. Its all-pattern baseline predicts every pattern for every report, yielding 29.3% Macro-F1; unparseable or invalid model decisions are treated as negative predictions.

  Section 5.2, Prompt design and Constant baseline; Table 9(b), report-level frequencies.

• supportsYuying Wang: Yuying Wang is listed as an author of arXiv:2610.13170v1. The paper lists affiliations with the Institute of Computing Technology, Chinese Academy of Sciences, and the University of Chinese Academy of Sciences.

  Author block preceding the abstract, arXiv:2610.13170v1.