COBALT-TLA: A Neuro-Symbolic Verification Loop for Cross-Chain Bridge Vulnerability Discovery

Abstract: We present COBALT-TLA, a neuro-symbolic verification loop that pairs an LLM with TLC, the TLA+ model checker, in an automated REPL. The LLM generates bounded TLA+ specifications; TLC acts as a semantic oracle; structured error traces are parsed and injected back into the model's context to drive convergence. We evaluate the system against three cross-chain bridge targets, including a faithful model of the Nomad $190M exploit. COBALT-TLA reaches a verified BUG_FOUND state in at most 2 iterations on all targets, with TLC execution consistently below 0.30 seconds. Notably, the system autonomously discovers an unprompted vulnerability class -- the Optimistic Relay Attack -- not present in the human-written baseline specification. We argue that deterministic prover feedback is sufficient to neutralize LLM hallucination in formal methods, transforming zero-shot code generation into a convergent proof-finding strategy.

• The paper introduces COBALT-TLA, a neuro-symbolic REPL framework that integrates LLM-generated TLA+ specifications with deterministic TLC feedback to achieve rapid convergence in under two iterations.
• The methodology combines prompt-engineered spec generation, bounded state space enforcement, and automated error trace extraction to detect temporal and concurrency flaws in cross-chain protocols.
• Experimental results demonstrate low TLC invocation latency (<0.30 seconds per run) and the autonomous discovery of previously undocumented vulnerabilities, underscoring its practical impact on blockchain security.

COBALT-TLA: Neuro-Symbolic Verification Loop for Cross-Chain Bridge Vulnerability Discovery

Introduction

"COBALT-TLA: A Neuro-Symbolic Verification Loop for Cross-Chain Bridge Vulnerability Discovery" (2604.12172) introduces a closed-loop system that leverages a neuro-symbolic architecture to generate and verify formal TLA+ models of distributed smart contracts, specifically addressing temporal vulnerabilities endemic to cross-chain bridges. The key innovation is a REPL framework that injects deterministic TLC model-checking feedback into the prompt context of an LLM, enabling rapid convergence to correctly bounded, exploitable protocol specifications without manual intervention. This system outperforms existing automated tools in uncovering concurrency and finality flaws, such as those responsible for the most financially severe blockchain exploits to date.

Motivation and Problem Landscape

Cross-chain bridge exploits have resulted in capital losses exceeding one billion USD, with attacks stemming not from low-level implementation bugs but from architectural flaws—typically, violations of temporal order and state synchronization across distributed machines. Existing static analyzers (Slither) and symbolic executors (Echidna, Z3) are intrinsically limited, operating at the intra-contract, single-threaded EVM level, and thus fundamentally unable to reason about cross-contract concurrency and off-chain relay semantics. TLA+ provides the necessary abstraction for capturing these temporal vulnerabilities but remains largely inaccessible to practitioners due to its mathematical complexity.

Zero-shot LLM-based code generation for TLA+ exacerbates the inaccessibility issue, routinely producing unbounded or semantically invalid specifications that defeat model checking. The absence of programmatic grounding for LLMs hinders their utility in practical formal methods.

System Architecture and Methodology

COBALT-TLA establishes a deterministic, agentic REPL that interleaves the generative capacity of LLMs with the precise state-space exploration of TLC. The architecture consists of four core components:

1. Prompt-Engineered Spec Generation: The LLM is provided with a fixed structural template for TLA+ module and configuration output, ensuring deterministic extraction and subsequent parsing.
2. Bounded State Space Enforcement: Generation is constrained by prompt-injected typing and explicit state bounds, avoiding the classical infinite state-space blowup of baseline LLM approaches.
3. Subprocess TLC Invocation: TLC is executed in isolation for each candidate model, with exit codes and full parse/violation traces exposed for further analysis.
4. Error Trace Extraction/Feedback: TLC outputs are normalized into succinct, actionable error summaries or counterexample traces that are then injected into the LLM's context for self-correction.

The LLM is conditioned to seek counterexamples rather than proofs of correctness, inverting standard verification framing. A state flagged as SAFE likely signals a model mis-specification. All system components are organized to drive rapid loop convergence and to minimize the impact of hallucinated or semantically invalid model generations.

Experimental Evaluation

COBALT-TLA was evaluated on three cross-chain bridge protocols: (T1) a human-validated "Lock-and-Mint" reorg exploit, (T2) emergent vulnerability specification on the same architecture, and (T3) a faithful reproduction of the \$190M Nomad exploit. Across all scenarios, COBALT-TLA converged to a valid explitable trace in$\leq 2$ iterations, with TLC model checking incurring less than 0.30 seconds per run. End-to-end pipeline latency is strictly governed by LLM inference times (17–49 seconds depending on target).

Notably, the system autonomously discovered an "Optimistic Relay Attack"—a vulnerability absent from the initial prompt and human-annotated baseline—demonstrating emergent vulnerability reasoning. For the Nomad exploit, the agent reconstructed the core sequence ($$\text{ActivateZeroRoot} \to \text{ExploitProcessWithoutProof}$$) in a model minimal to three states.

Strong claims include:

• COBALT-TLA neutralizes LLM hallucinations in TLA+ formal specification through deterministic prover feedback, achieving robust model convergence in minimal iterations.
• The system independently surfaces previously undocumented vulnerability classes via neuro-symbolic interaction.

Theoretical and Practical Implications

The research establishes that deterministic, high-speed provers can be leveraged as semantic oracles for LLM-based formal specification, transforming nondeterministic code generation into a guided, convergent search over the space of possible specifications. This interaction paradigm is reminiscent of interactive proof assistants but is here fully automated.

Practically, COBALT-TLA marks the first implementation with the capacity to autonomously diagnose and generate attack traces for temporal concurrency flaws in Web3 infrastructure—vulnerabilities that have historically eluded both static and dynamic analyzers and have led to systemic financial loss. The approach reframes LLM utility in formal methods: not as automata for final proofs, but as adaptable hypothesis generators whose search is grounded in formal, mechanized feedback.

Theoretically, the results support the hypothesis underpinning bounded model checking: critical vulnerabilities manifest in low-depth, small-constant executions. Extensions to higher state bounds do not materially affect exploit depth for the classes examined, and thus the method scales to realistic protocol modeling.

Limitations and Scope

Several explicit limitations are identified:

• Domain Restriction: The method is tailored for cross-chain bridges and temporal ordering violations; arithmetic bugs and reentrancy are not in scope.
• Abstraction Level: Specification is at the protocol (architectural) level, abstracting away gas, nonces, and EVM bytecode, which may miss implementation-specific flaws.
• Production Code Coverage: There is no live connection to deployed smart contract bytecode; extending this requires seamless integration with low-level semantic frameworks (e.g., KEVM).
• LLM Stochasticity: While empirical convergence is rapid and robust, formal guarantees of total determinism are not attempted.

Future Directions

Further development will focus on vertical integration of COBALT-TLA with EVM semantics (e.g., via KEVM), enabling protocol-to-implementation level verification, as well as expanding the neuro-symbolic paradigm to cover a broader set of distributed systems and vulnerability classes. Improvements to LLM controllability and context management will further enhance reliability and coverage.

Conclusion

COBALT-TLA articulates a neuro-symbolic, REPL-based approach for autonomous discovery of temporal vulnerabilities in distributed smart contracts. Through tightly coupled LLM generation and TLC-driven prover feedback, the system achieves rapid, self-correcting formal specification and exploit trace generation for high-impact security flaws in cross-chain bridges. These results indicate a new, practically viable path forward for protocol-level formal verification in decentralized finance, with potential applicability across a range of temporal and concurrent system designs.