feat: Implement Cross-Chain Re-Entrancy & Double-Spend Anomaly Detect…

[0xApana]

Description

Closes #1003

This PR implements the real-time Cross-Chain Re-Entrancy & Double-Spend Anomaly Detection Engine with Automated Flash-Pause (crossChainAnomalyEngine.service.ts).

During high cross-chain throughput, exploits such as token double-minting across EVM-Stellar bridge relayers or re-entrancy attacks during cross-chain state updates can occur within sub-second block windows. This engine inspects event streams in real time to catch exploits before standard batch reconciliation jobs run.

Summary of Changes

• Stream Graph Analyzer (crossChainAnomalyEngine.service.ts):

  • Implemented real-time event stream analysis operating over Horizon SSE and EVM WebSocket event feeds.
  • Implemented dual-layer (L1 In-Memory + L2 Redis) sliding window tracking for sub-millisecond execution analysis.
  • Added Double-Spend Anomaly Detection to catch duplicate deposit transaction hashes across multiple chains/relayers before final settlement.
  • Added Out-of-Order Sequence Nonce Jump Detection to flag nonces skipping forward or regressing out of sequence.
  • Added Cross-Chain Re-Entrancy Detection to catch rapid sub-second duplicate calls with matching deposit references.
  • Added Automated Flash-Pause trigger that directly invokes Soroban pause_contract RPC (pause_bridge / pause_global), sets emergency circuit breaker flags in Redis, increments Prometheus metrics (circuitBreakerTrips), and records critical alert events when the anomaly threshold is breached within a 5-second window.
  • Provided manual emergency breaker check (isEmergencyBreakerActive) and recovery reset (resetEmergencyBreaker) methods.

• Event Stream Federation Integration (EventFederationService.ts):

  • Integrated CrossChainAnomalyEngineService into event stream ingestion (_ingest) to process federated stream events automatically in real time.

• Testing:

  • Added unit test suite crossChainAnomalyEngine.service.test.ts covering double-spend, sequence jump, re-entrancy detection, Flash-Pause triggering, and breaker recovery flows.
  • Added integration test suite anomalyEngine.integration.test.ts simulating double-mint exploits across relayers.

Verification

• npm --prefix backend run test:unit -- tests/services/crossChainAnomalyEngine.service.test.ts (All 7 unit tests passed)
• npm --prefix backend run build (TypeScript compilation succeeded with 0 errors)

[0xApana]

Please review my work.

[Mosas2000]

The implementation of the Cross-Chain Re-Entrancy & Double-Spend Anomaly Detection Engine is exceptionally well-architected.

[Mosas2000]

The sub-second graph analysis and automated flash-pause mechanisms seamlessly integrate with the event federation and circuit breaker services. Given the robust test coverage for double-spend, nonce jumps, and re-entrancy vectors.

Thank you for your perfect work.