Ilmu Komputer & AI editorial
IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges
The core problem
Cross-chain bridges transfer value between blockchains, and intent-based bridges introduce a solver that fulfills a user's declared outcome while an off-chain settlement layer later reconciles the fill against the deposit. This architecture delegates settlement exposure to off-chain components, but it also creates a class of on-chain safety properties that must be enforced locally by the bridge contracts. Existing smart-contract fuzzers and static analyzers are ill-suited to this setting: they either flag known-bad code patterns or require protocol-specific hand-written assertions, which do not scale to the diversity of intent-based bridge designs.
The paper formalizes a taxonomy that separates **invariant violations**—safety properties a contract must enforce locally—from **settlement exposures** that are legitimately delegated to the off-chain settlement layer. This distinction is critical because not every anomalous state is a bug; some are by design. The authors then propose **IntentFuzz**, a protocol-aware fuzzer that recovers a bridge's intent structure and deposit/fill function roles directly from unannotated Solidity source, and synthesizes multi-step fuzz sequences using
Innovation
IntentFuzz was evaluated on multiple benchmarks. It recovered the correct intent structure in **9/9** benchmark protocols and classified deposit and fill functions with **100% recall** and **82% combined precision**. Across a corpus of **77 manually labeled contracts**, it reached **79.5% bridge-classification precision** and **97.2% recall**. Among confirmed bridges, struct selection reached **88.6% precision and recall**, while deposit and fill classification each reached **100% recall**.
On **23 planted-bug mutants**, IntentFuzz attained **100% recall and 100% precision**, executing **273 templates** (**507 transactions**) in a median of **14ms per template**. Across **24 real-world deployments**, it confirmed **17 genuine invariant violations** under heuristic-only input generation, rising to **22** with its LLM-assisted tier enabled. These findings span **eight vulnerable GitHub repositories**, and each finding is reproducible against public, deployed bytecode.
The results demonstrate that protocol-aware fuzzing can automatically detect invariant violations in intent-based bridges without hand-written assertions. The LLM-assisted tier significantly improves detection coverag
Why it matters
The taxonomy separating invariant violations from settlement exposures provides a principled foundation for automated detection. By focusing on locally enforceable safety properties, IntentFuzz avoids false positives that would arise from flagging legitimate off-chain delegations. The high recall on deposit and fill classification (100%) is particularly important because misclassifying these roles would lead to missed or spurious invariant checks.
The LLM-based fallback is a double-edged sword: it improves detection (17 to 22 confirmed violations) but introduces a dependency on model behavior. The paper does not report precision for the LLM-assisted tier on real-world deployments, leaving open the question of false positive rates. Nevertheless, the reproducibility of findings against public bytecode is a strong validation.
The performance (median 14ms per template) suggests IntentFuzz is practical for CI integration. The ability to recover intent structure from unannotated source means it can be applied to deployed contracts without source access, broadening its applicability. Future work could extend the taxonomy to other cross-chain patterns and integrate formal verification for the invariants themselves.
Overall, IntentFuzz represents a significant step toward automated security analysis of intent-based bridges, combining protocol-aware static analysis with LLM-assisted fuzzing to detect real-world vulnerabilities.
Who should read this
Opening member content…