Verification Logic Failures Expose Cross-Chain System Vulnerabilities

The recent failure of Coreum's XRPL bridge highlights a critical vulnerability in cross-chain systems. The incident shows that even when private keys are secure, verification logic can still fail, resulting in significant losses. In this case, nearly 200,000 XRP were lost without any stolen key.

Coreum's own developer documentation reveals the complexity of the bridge system. It uses a multisigning account on the XRP Ledger, a smart contract on Coreum, a token registry, and a relayer network that listens for events and triggers transfers. The XRPL-to-Coreum flow involves users sending payments to the multisig account with details for the Coreum recipient.

The relayer is a critical component of this system, but its role in bridging assets between chains can also be a point of failure. A multisignature structure may provide some security, but it cannot prevent errors if enough relayers accept false premises. This vulnerability is not unique to the Coreum bridge, as similar incidents have occurred with Ronin, Wormhole, and Poly Network.

Audits, like the one conducted by Certik on the Coreum bridge, can help identify potential issues but are no guarantee of security. A bridge is a dynamic system that requires ongoing maintenance and monitoring to ensure its continued operation.