Skip to content
Fuga Labs
Scope an engagement
Sector preset

Bridges

For the asset class with the worst historical loss severity, and the most conservative defaults in the product.

Scope an engagement Every sector preset
PresetonboardBridgeDetectors in play12Boundaries declared3Refusals at onboarding1

How this sector loses money.

Cross-chain bridge exploits now total roughly $2.9B, and in Q2 2026 alone they accounted for $351M. For most bridge designs the authority that authorises a mint is an off-chain validator set, so a compromise produces a mint that is correctly signed and completely fraudulent.

Answered by
  • 7Deterministic rules
  • 3Invariants
  • 2Models

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardBridge(platform, config) 7 configured
  1. 01Every side of every asset declared, source and destination, across every chain
  2. 02Message correspondence: every destination mint must match a source lock or burn
  3. 03Mint caps per window per destination chain, as event invariants
  4. 04Atomic value conservation over escrow addresses at zero fee tolerance
  5. 05Supply-versus-backing as a state invariant across bridged assets
  6. 06Full authority surface on both legs: admin changes, EOA role grants, upgrade diffs, uninitialised proxies
  7. 07Fund-flow and peel-chain analysis on anything that does leave
Detectors in play
  • inv.bridge-message-correspondence
  • inv.atomic-value-conservation
  • invariants.event
  • rules.admin-authority-change
  • rules.role-granted-to-eoa
  • rules.upgrade-implementation-diff
  • rules.uninitialized-proxy
  • rules.critical-selector
  • rules.proportional-drain
  • rules.multi-token-sweep
  • ml.fundflow-anomaly
  • ml.peel-chain-laundering

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge The validator or guardian set is off-chain in most bridge designs, so a compromise produces a mint that is correctly signed and fraudulent.
Closed by Closed by supply-versus-backing: the one check that does not care whether the signature was valid. A correctly signed mint with no backing behind it still fails the invariant, which is why this vertical treats it as mandatory.
The edge Correspondence is bounded by how completely each source chain is observed.
Closed by Closed by measuring coverage instead of assuming it. Every source chain reports observed block contiguity, and the rule refuses to gate on a chain whose coverage it cannot vouch for, because reporting a monitoring gap as a theft is how a control ends up switched off.
The edge A finality reorg on the source chain can retract a lock after its mint has landed.
Closed by Closed by reorg-aware marking. An unfinalised lock is explicitly flagged as not-reorg-final, so a retraction surfaces as a detected event with an owner, rather than as a silent divergence discovered during a month-end reconciliation.
An asset declared on a destination chain with no corresponding source side is rejected at onboarding, rather than accepted with a warning.

Left configured, every legitimate mint on that chain has no source leg to match and looks unbacked. The operator then raises the tolerance or mutes the rule, and the bridge ends up with less coverage than if it had never been onboarded. A configuration that predictably ends in a disabled control is broken, not conservative.

A default that is a refusalEnforced at onboarding, before anything is configured

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Both sides of every asset, on every chain. A destination declared with no source side is rejected rather than accepted with a warning, which makes the declaration the longest part of the call.

  2. Step 2

    Detect

    Every destination mint must match a source lock or burn. Supply against backing is the check that does not care whether the signature was valid, which is why it is mandatory in this preset.

  3. Step 3

    Prevent

    The bounded action is a mint ceiling per window per destination chain. It gates only on chains whose observed contiguity we can vouch for, because reporting our own monitoring gap as a theft switches a control off.

What runs underneath.

Whole-chain verification on export is what makes correspondence defensible, because the claim is worth exactly what its coverage evidence is worth.

The base under all eleven presets

Scope Bridges coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset