IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges
IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.
IntentFuzz formalizes a taxonomy separating invariant violations from settlement exposures in intent-based cross-chain bridges, then recovers a bridge's intent structure and deposit/fill function roles from unannotated Solidity source. It classified deposit and fill functions with 100% recall and 82% combined precision, and achieved 100% recall and precision on 23 planted-bug mutants. Across 24 real-world deployments it confirmed 17 genuine invariant violations with heuristic-only input generation, rising to 22 with its LLM-assisted tier, spanning eight vulnerable GitHub repositories with findings reproducible against public deployed bytecode.
- Formal taxonomy separates local invariant violations from off-chain settlement exposures.
- Recovers correct intent structure in 9/9 benchmark bridge protocols.
- Confirmed 22 invariant violations across 24 real-world deployments, eight GitHub repositories.
- LLM-assisted tier raises confirmed violations from 17 to 22.
- Deposit and fill classification each reach 100% recall.
Full article223 words · extracted from arxiv.org · click to collapse
Cross-chain bridges move value between blockchains. Intent-based bridges are a variant where a solver fulfills a user's declared outcome and an off-chain settlement layer later reconciles the fill against the deposit. Existing smart-contract fuzzers and static analyzers only flag known-bad code patterns or require protocol-specific hand-written assertions. This work formalizes a taxonomy separating invariant violations, safety properties a contract must enforce locally, from settlement exposures legitimately delegated to the off-chain settlement layer, and proposes IntentFuzz: a protocol-aware fuzzer that recovers a bridge's intent structure and deposit/fill function roles directly from unannotated Solidity source, then synthesizes multi-step fuzz sequences using an LLM-based fallback to help build call arguments. IntentFuzz recovers the correct intent structure in 9/9 benchmark protocols and classifies deposit and fill functions with 100% recall and 82% combined precision; across a corpus of 77 manually labeled contracts, it reaches 79.5% bridge-classification precision and 97.2% recall, and among confirmed bridges, struct selection reaches 88.6% precision and recall while deposit and fill classification each reach 100% recall. On 23 planted-bug mutants, IntentFuzz attains 100% recall and 100% precision, executing 273 templates (507 transactions in a median of 14ms per template). Across 24 real-world deployments, it confirms 17 genuine invariant violations under heuristic-only input generation, rising to 22 with its LLM-assisted tier enabled, spanning eight vulnerable GitHub repositories, each finding reproducible against public, deployed bytecode.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.13004