一句话：首次研究跨链桥安全，归纳三类新漏洞并实现自动检测工具 Xscope，可发现已知与未知攻击。
跨链桥因支持异构区块链间资产互操作而流行，但其链上智能合约与链下程序协同的复杂流程带来严重安全隐患，过去一年已发生十余起重大攻击并造成巨额损失。现有研究匮乏，社区缺少缓解此类威胁的知识与工具。本文首次系统研究跨链桥安全：记录三类新的安全缺陷，并提出一组安全属性与模式来刻画它们；基于这些模式设计自动检测工具 Xscope，用于发现跨链桥中的安全违规并检测真实攻击。作者在四个流行跨链桥上评估 Xscope，它能成功检测所有已知攻击，并发现此前未报告的疑似攻击。视频见链接。
Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY.