The cross-chain bridge handles over $14 billion in user assets across Ethereum L1, multiple L2s (Optimism, Arbitrum, zkSync, StarkNet) and other chains, and an assessment combines on-chain analysis, fuzzing, formal verification, and threat modeling to surface high-impact gaps.

Risk is high‑medium with a composite score of 7.4 out of 10, driven by gaps in validator decentralization, fraud‑proof latency, and cross‑chain replay protection.

Separately, the Polygon Bridge (Ethereum to Polygon) manages over $2.8 billion and was audited for reentrancy and access control, yielding a medium‑high risk score of 6.5/10.

Technical recommendations prioritize hardening critical paths: add reentrancy guards on deposit/withdraw paths, migrate admin to a multisig with timelock, separate pause and upgrade roles, and implement checkpoint freshness checks.

Additional targeted actions include capping batch sizes, timelocked verification for tunnel changes, a safe ERC777 wrapper for tokens, and considering formal verification of proof logic alongside on‑chain monitoring and alerting.

Immediate mitigations focus on reentrancy and relayer protections, expanding the validator set with misbehavior proofs, embedding destination chain IDs and domain separation in signed messages, and introducing a withdrawal queue with rate limits and gas guards.

Other high‑priority steps include a bridge pause mechanism, upgraded governance with time delays and veto, relayer staking with slashing, MEV‑resistant relayer selection, and formal verification of upgrade paths.

Note: All points are drawn from the provided article text and do not incorporate external information.

Conclusion: The bridge is functionally solid but centralized in key areas and vulnerable to high‑impact exploits; implementing the recommended remediation could substantially reduce risk within a few months, aligning with industry best practices.

Findings indicate potential indirect reentrancy via Predicate contracts and MessageSender, plus overprivileged admin accounts with centralized upgrade/pause capabilities, creating medium‑high risk even without an immediate drain.

Identified attack vectors include reentrancy in BridgeRelayer, cross‑chain replay without chain‑ID in proofs, single‑key admin with upgrade control, and lack of per‑token exit caps, all of which could enable double‑minting, asset drains, or governance bypass.

Conclusion: The Polygon Bridge is robust but requires prompt mitigations to reduce medium‑to‑high risks; there were no instant‑drain vulnerabilities found in this audit.