Exploiting Liquidity Exhaustion Attacks in Intent-Based Cross-Chain Bridges

TL;DR

This paper identifies and analyzes liquidity exhaustion attacks in intent-based cross-chain bridges, revealing vulnerabilities in protocols with high solver profitability and proposing strategies to reduce attack costs.

Contribution

It introduces a new class of liquidity exhaustion attacks, provides a replay-based simulation framework, and evaluates real-world data across multiple protocols and blockchains.

Findings

Protocols with higher solver profitability are more vulnerable to attacks.

Across protocol remains robust due to low margins and high liquidity.

Attack strategies can be optimized to significantly reduce attack costs.

Abstract

Intent-based cross-chain bridges have emerged as an alternative to traditional interoperability protocols by allowing off-chain entities (\emph{solvers}) to immediately fulfill users' orders by fronting their own liquidity. While improving user experience, this approach introduces new systemic risks, such as solver liquidity concentration and delayed settlement. In this paper, we propose a new class of attacks called \emph{liquidity exhaustion attacks} and a replay-based parameterized attack simulation framework. We analyze 3.5 million cross-chain intents that moved \$9.24B worth of tokens between June and November 2025 across three major protocols (Mayan Swift, Across, and deBridge), spanning nine blockchains. For rational attackers, our results show that protocols with higher solver profitability, such as deBridge, are vulnerable under current parameters: 210 historical attack instances yield a mean net profit of \$286.14, with 80.5\% of attacks profitable. In contrast, Across remains robust in all tested configurations due to low solver margins and very high liquidity, while Mayan Swift is generally secure but becomes vulnerable under stress-test conditions. Under byzantine attacks, we show that it is possible to suppress availability across all protocols, causing dozens of failed intents and solver profit losses of up to \$978 roughly every 16 minutes. Finally, we propose an optimized attack strategy that exploits patterns in the data to reduce attack costs by up to 90.5\% compared to the baseline, lowering the barrier to liquidity exhaustion attacks.