Cross-Chain Replay Attack

Overview

A Cross-Chain Replay Attack occurs when a valid signed transaction or message intended for one blockchain, fork, domain, bridge, or contract is reused in another context where it is also accepted. The control exists to reduce technical, fraud, and financial risk arising from blockchain transactions, signatures, smart contracts, clients, bridges, wallets, and public transaction data. It differs from an ordinary duplicate submission because the harmful reuse crosses a trust or execution domain. It should be interpreted alongside EIP-712 Typed Data because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow identifies the exact network, contract, implementation, message, signer, asset, dependency, and expected state transition. Systems should verify domain and chain context, authoritative addresses, signatures, nonces, code or client versions, confirmations, and the difference between observable data and inferred ownership. In this context, protection requires domain separation, chain and contract identifiers, nonces, expiry, consumed-message tracking, canonical encoding, bridge-specific replay controls, and verification that signatures authorize the exact network and action.

It should connect the term to Contract Verification where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should retain transaction and block identifiers, contract addresses, network and chain ID, decoded input, signer, signature domain, client version, timestamps, confirmations, attribution source, alerts, decisions, and resulting state. Reorganizations, bridges, proxies, and off-chain dependencies require explicit treatment.

Useful measures include affected value, suspicious exposure, signature warnings, replay or duplicate attempts, client concentration, failed validation, contract mismatches, investigation time, unresolved attribution, and recovery outcomes.

The relationship with Duplicate Payout should be documented where it affects residual risk or control ownership.