A Systematic Taxonomy and Risk-Scoring Framework for Cross-Chain Bridge Security: Design, Retrospective Validation, and Comparative Analysis

Abstract Cross-chain bridges have become indispensable in frastructure for asset and data portability across heterogeneous blockchains, yet they remain the single most exploited category of decentralized-finance infrastructure, with cumulative publicly reported losses exceeding two billion US dollars since 2021. Existing literature addresses this problem from two largely disconnected angles: broad interoperability surveys that cat alogue protocol families, and narrower security studies that catalogue historical incidents. Neither strand provides a reusable, transparent instrument that lets a developer or auditor estimate a candidate bridge’s exposure to known attack classes before deployment, using only publicly observable design parameters.

This paper addresses that gap. We conduct a PRISMA-guided systematic literature review of blockchain-interoperability and bridge-security research, from which we derive a unified tax onomy cross-tabulating bridge architectures, verification models, communication models, trust assumptions, and attack categories. Building on this taxonomy, we propose the Bridge Security Risk Score (BSRS), a rule-based, auditable scoring framework– deliberately not a machine-learning model– that maps seven publicly inspectable architectural parameters to a quantified risk estimate.

We retrospectively validate BSRS against eight publicly documented bridge incidents (Ronin, Wormhole, Poly Network, Nomad, Harmony Horizon, Multichain, ChainSwap, Qubit) and two non-exploited comparators (LayerZero, Axelar), and find that the framework consistently assigns higher risk bands to the exploited designs. We discuss the limitations of retrospective vali dation, threats to validity, and directions for extending this work toward automated, PhD-level formal-verification and disclosure standardization research.