Two critical bugs found in the Cronos Gravity Bridge allowing attackers to halt cross-chain transfers from Ethereum to Cronos and disable the bridge entirely. The vulnerabilities stem from incorrect validation of ERC-20 deployment events causing nonce mismatches between chains, and malicious token supply causing bridge deactivation.
Scroll executed an emergency upgrade on April 25, 2025 to patch two critical vulnerabilities: a soundness bug in OpenVM 1.0.0's auipc opcode circuit (off-by-one in enumeration causing insufficient range checking) and a message spoofing vulnerability in the bridge's EnforcedTxGateway contract that could allow arbitrary token minting on L2.
Collection of three smart contract vulnerability writeups covering critical access control issues: Betverse ICO's public transferTokenToLockedAddresses() function enabling token theft, Ocean Protocol's unprotected ownerWithdraw() function allowing unauthorized fund transfer, and Oasys L1 bridge contract vulnerability enabling NFT theft.