Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Exploiting Liquidity Exhaustion Attacks in Intent-Based Cross-Chain Bridges

André Augusto, Christof Ferreira Torres, André Vasconcelos, Miguel Correia

TL;DR

This paper proposes a new class of attacks called liquidity exhaustion attacks and a replay-based parameterized attack simulation framework, and proposes an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.

Abstract

Intent-based cross-chain bridges have emerged as an alternative to traditional interoperability protocols by allowing off-chain entities (\emph{solvers}) to immediately fulfill users' orders by fronting their own liquidity. While improving user experience, this approach introduces new systemic risks, such as solver liquidity concentration and delayed settlement. In this paper, we propose a new class of attacks called \emph{liquidity exhaustion attacks} and a replay-based parameterized attack simulation framework. We analyze 3.5 million cross-chain intents that moved \$9.24B worth of tokens between June and November 2025 across three major protocols (Mayan Swift, Across, and deBridge), spanning nine blockchains. For rational attackers, our results show that protocols with higher solver profitability, such as deBridge, are vulnerable under current parameters: 210 historical attack instances yield a mean net profit of \$286.14, with 80.5\% of attacks profitable. In contrast, Across remains robust in all tested configurations due to low solver margins and very high liquidity, while Mayan Swift is generally secure but becomes vulnerable under stress-test conditions. Under byzantine attacks, we show that it is possible to suppress availability across all protocols, causing dozens of failed intents and solver profit losses of up to \$978 roughly every 16 minutes. Finally, we propose an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5\% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.

Exploiting Liquidity Exhaustion Attacks in Intent-Based Cross-Chain Bridges

TL;DR

This paper proposes a new class of attacks called liquidity exhaustion attacks and a replay-based parameterized attack simulation framework, and proposes an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.

Abstract

Intent-based cross-chain bridges have emerged as an alternative to traditional interoperability protocols by allowing off-chain entities (\emph{solvers}) to immediately fulfill users' orders by fronting their own liquidity. While improving user experience, this approach introduces new systemic risks, such as solver liquidity concentration and delayed settlement. In this paper, we propose a new class of attacks called \emph{liquidity exhaustion attacks} and a replay-based parameterized attack simulation framework. We analyze 3.5 million cross-chain intents that moved \286.14, with 80.5\% of attacks profitable. In contrast, Across remains robust in all tested configurations due to low solver margins and very high liquidity, while Mayan Swift is generally secure but becomes vulnerable under stress-test conditions. Under byzantine attacks, we show that it is possible to suppress availability across all protocols, causing dozens of failed intents and solver profit losses of up to \$978 roughly every 16 minutes. Finally, we propose an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5\% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.
Paper Structure (36 sections, 8 equations, 11 figures, 8 tables)

This paper contains 36 sections, 8 equations, 11 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Cross-Chain Bridges and Intents
  3. Cross-Chain Intents
  4. Solver Behavior and Liquidity
  5. Liquidity Exhaustion Attacks
  6. Adversarial Model
  7. Attack Models
  8. Liquidity Exhaustion and Attack Induction Cost
  9. Cost to Fill Intents
  10. Attack Revenue
  11. Net Profit
  12. Data Collection and Analysis
  13. Dataset Overview
  14. Vulnerabilities Identified
  15. Attack Simulation Framework
  16. ...and 21 more sections

Figures (11)

  • Figure 1: Cross-chain transaction flow from Solana to Ethereum using Mayan Swift's bridge (a Wormhole bridge).
  • Figure 2: Simplified token routing: low-liquidity tokens are converted to a small set of high-liquidity tokens (e.g., ETH, USDC, USDT) for efficient solver balance management. If the user requests a different token on the destination chain, these are optionally swapped accordingly.
  • Figure 3: Sequence diagram of a liquidity exhaustion attack, showing the interaction between attacker, solvers, and protocol.
  • Figure 4: Hourly distribution of intent volume for deBridge, showing strong temporal concentration of value transacted between 9am-2pm EST.
  • Figure 5: Hourly liquidity injections (bars) versus solver balance (dashed line) for Mayan Swift’s top solver between June 20 and June 30, 2025. The data reveals no automatic mechanism of injection of liquidity once liquidity goes below a certain threshold.
  • ...and 6 more figures