Skip to content

Cross-chain address ambiguity causing irreversible asset immobilization #983

@arubendiaz-rgb

Description

@arubendiaz-rgb

A cross-chain usability issue was identified involving EVM-compatible address overlap across networks.

On January 27, 2026, BTC was converted to RBTC using the PowPeg bridge on Rootstock.

RBTC were minted to the address:

0x441FCB23dFE8289cF572126fEDcF450974ADC891

The address is syntactically valid but corresponds to a smart contract deployed on another EVM network (Base), not to an externally owned account controlled by the user on Rootstock.

Because the bridge interface validates only address syntax and not semantic account type (EOA vs Smart Contract), the system allowed minting to an address that cannot be controlled by the user.

Result: RBTC remain permanently immobilized on-chain.

This is not a protocol exploit or hack.
It highlights a structural UX risk in multi-EVM cross-chain environments.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions