Replay attack

Re-submitting a message that was already valid once, in a context where nothing prevents it from being accepted again.

Why it matters

Systems that verify a proof or a signature must also record that it has been used. Where that bookkeeping is missing or initialised wrongly, a single valid message becomes reusable, and the exploit needs no cryptographic break — only the willingness to send it repeatedly.

What you can check

The defence is usually a nonce, a used-message registry, or a domain separator binding a signature to one chain and one contract. Post-mortems name which of these was absent.

Where it showed up

Records in the Incident Tracker that turn on this: Nomad bridge replay exploit.