Securing Cross-Chain Multisignature Execution Through Deterministic Enforcement and Explainable Anomaly Awareness
TL;DR
Results indicate that a machine learning advisor can extend anomaly-prioritization coverage beyond the scope of the deterministic predicates while leaving execution control fully deterministic.
Abstract
Cross-chain bridges represent one of the most damaging attack surfaces in decentralized finance, with major exploits (e.g., Ronin, Wormhole, Nomad, Multichain) arising not from broken signature schemes but from failures in proof verification, replay protection, and signer-set management, gaps that conventional threshold-signature multisignature wallets do not address. This study presents an incident-aware multisignature architecture combining three on-chain predicates—block-height freshness windows, epoch-bound signer sets, and Merkle inclusion-proof verification—with a non-authoritative off-chain LightGBM classifier that generates SHAP-attributed risk explanations to support governance actions such as pausing, vetoing, or rotating signers, without directly blocking or approving execution. The framework was evaluated on a simulated benchmark of 78,600 Ethereum testnet transactions containing six injected anomaly classes (gas spikes, nonce jitter, malformed call data, stale intents, proof-delivery delays, and epoch-rotation replays). The LightGBM advisor achieved ROC-AUC 0.92 (95% CI [0.906, 0.926]) and F1 0.73 ([0.712, 0.749]), outperforming five baselines—logistic regression, Random Forest, XGBoost, isolation forest, and a rule-based detector—with the highest F1 (0.731) and PR-AUC (0.799), while the rule-based detector, which by construction covers only the anomaly classes addressed by the deterministic predicates, attained F1 0.282. Differences were statistically significant except for the LightGBM–XGBoost PR-AUC comparison. The deterministic layer itself is verified through 28 property-level contract tests covering all seven modeled attack objectives, with measured per-function gas costs (execute_Intent: 118,756 gas, of which 28,432 gas is Merkle-proof verification). Within this controlled setting, the results indicate that a machine learning advisor can extend anomaly-prioritization coverage beyond the scope of the deterministic predicates while leaving execution control fully deterministic. This work is presented as a controlled proof of concept: the reported metrics quantify recovery of scripted injection patterns, and validation against real-world exploit traces remains future work.