Exploiting Liquidity Exhaustion Attacks in Intent-Based Cross-Chain Bridges

2026-02-19

AI Summary

Intent-based cross-chain bridges, which rely on solvers to provide liquidity, face systemic risks such as liquidity concentration and settlement delays. This work introduces and systematically analyzes the “liquidity exhaustion attack” for the first time, proposing a replay-based, parameterized attack simulation framework. We conduct an empirical study on 3.5 million cross-chain intents across nine blockchains in three major protocols, leveraging large-scale on-chain data analysis, economic profit modeling, and parameterized replay testing. Our findings reveal stark differences in protocol resilience under rational and Byzantine attacks: deBridge is vulnerable under current parameters (yielding an average net profit of $286.14 per historical attack), whereas Across remains robust due to high liquidity and low profitability for attackers. The proposed optimization strategies can reduce attack costs by up to 90.5%, with Byzantine attacks potentially costing solvers nearly $1,000 every 16 minutes.

Technology Category

• Search and Optimization: Distributed Search
• Reasoning under Uncertainty: Stochastic Optimization
• Multiagent Systems: Mechanism Design

Application Category

• Economics, Online Markets and Human Computation: Economic aspects of blockchain and cryptocurrencies
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Intent-based cross-chain bridges have emerged as an alternative to traditional interoperability protocols by allowing off-chain entities (\emph{solvers}) to immediately fulfill users'orders by fronting their own liquidity. While improving user experience, this approach introduces new systemic risks, such as solver liquidity concentration and delayed settlement. In this paper, we propose a new class of attacks called \emph{liquidity exhaustion attacks} and a replay-based parameterized attack simulation framework. We analyze 3.5 million cross-chain intents that moved \$9.24B worth of tokens between June and November 2025 across three major protocols (Mayan Swift, Across, and deBridge), spanning nine blockchains. For rational attackers, our results show that protocols with higher solver profitability, such as deBridge, are vulnerable under current parameters: 210 historical attack instances yield a mean net profit of \$286.14, with 80.5\% of attacks profitable. In contrast, Across remains robust in all tested configurations due to low solver margins and very high liquidity, while Mayan Swift is generally secure but becomes vulnerable under stress-test conditions. Under byzantine attacks, we show that it is possible to suppress availability across all protocols, causing dozens of failed intents and solver profit losses of up to \$978 roughly every 16 minutes. Finally, we propose an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5\% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.

Problem

• liquidity exhaustion attacks
• intent-based cross-chain bridges
• systemic risk
• solver liquidity
• cross-chain interoperability

Innovation

• liquidity exhaustion attacks
• intent-based cross-chain bridges
• attack simulation framework
• solver liquidity risk
• cross-chain security