cross-chain-messaging

# Cross-chain messaging detection ## When this applies - Any application built on LayerZero, CCIP, Hyperlane, Wormhole, Axelar, Polyhedra ZKBridge - Native L1↔L2 messengers (Optimism, Arbitrum, Base, zkSync, Linea, Scroll) - Custom bridges / message-passing layers ## Detection patterns ### `_lzReceive` accepts any remote (CRITICAL — LayerZero) ```solidity function _lzReceive(bytes calldata srcAddr, bytes calldata payload) internal { // no allowlist of trusted remote _executeMint(payload); // ← any chain can mint } ``` Required: `require(trustedRemote[srcChainId] == srcAddr)`. ### CCIP `ccipReceive` callable directly (CRITICAL) ```solidity function ccipReceive(Any2EVMMessage calldata m) external { // ← public, no router check _execute(m.data); } ``` Required: `require(msg.sender == address(router))`. ### Hyperlane `handle` without ISM check (CRITICAL) Hyperlane's default ISM is permissive. Apps must set their own. If `handle` is called by mailbox without app-side validation, anyone can spoof messages. ### Wormhole VAA double-spend (CRITICAL) ```solidity function complete(bytes calldata vaa) external { IWormhole.VM memory vm = wormhole.parseAndVerifyVM(vaa); _mint(vm.payload.to, vm.payload.amount); // ← no per-VAA seen check } ``` Required: track `usedVAAs[vm.hash] = true` after first use. ### Replay across chains (CRITICAL) Same payload accepted on multiple destination chains. Include destination `chainId` in the signed/verified payload. ### ...