Insights on Crypto Payments, Infrastructure, and Operations

Cross-Chain Replay Attack

Security, Risk & Compliance

Pronunciation: KRAWS-chayn REE-play uh-TAK

Definition

A Cross-Chain Replay Attack occurs when a valid signed transaction or message intended for one blockchain, fork, domain, bridge, or contract is reused in another context where it is also accepted.

Overview

Contents Hide
  1. How it works and why it matters
  2. Technical context
  3. Practical checks
  4. Related concepts

How it works and why it matters

A cross-chain replay attack uses a valid signature or message from one chain or domain in another context where it should not authorize the same action. Risk depends on whether the signed payload binds the chain, contract, nonce and intended action. Chain identifiers and domain-separated signatures reduce accidental reuse but must be implemented correctly. Bridge messages also need unique identifiers and consumption tracking to prevent duplicate claims.

Technical context

It differs from an ordinary duplicate submission because the harmful reuse crosses a trust or execution domain.

In this context, protection requires domain separation, chain and contract identifiers, nonces, expiry, consumed-message tracking, canonical encoding, bridge-specific replay controls, and verification that signatures authorize the exact network and action.

Practical checks

Ensure signed messages carry a chain-specific domain, destination contract, unique nonce and explicit permitted action. On each destination, track consumed messages to prevent duplicate execution. During chain forks and upgrades, reevaluate replay boundaries; copied contract addresses on EVM-compatible chains do not make signatures automatically chain-specific.

EIP-712 Typed Data; Contract Verification; Duplicate Payout

Example

A wallet signs an authorization for a token contract on chain A. If an equivalent contract on chain B accepts the same unscoped signature, an attacker may reuse it to trigger an unintended allowance or transfer. Correct chain and contract binding blocks that reuse.

Comparison

Replay differs from simply submitting an unconfirmed transaction again on the same chain. Cross-chain replay exploits missing boundaries between authority domains.

Key Takeaway

Ensure signatures and bridge messages are bound to their intended chain and use.

Sources

  1. EIP-155: Simple Replay Attack Protection — Ethereum Improvement Proposals (2026-08-03)
  2. EIP-712: Typed Structured Data Hashing and Signing — Ethereum Improvement Proposals (2026-08-03)
  3. Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Rev. 5 — NIST (2026-08-03)