Why Most Cross-Chain Bridges Get Hacked

A deep dive into the NFT-based publishing system and its critical limitations that every Solana Mobile developer should know about.

The Promise vs. The Reality

When we started building on Solana Mobile’s publish platform, we were excited about the innovative approach: using NFTs to manage app versions and ownership. The concept seemed elegant — each app gets a main NFT, and every new version mints a new NFT. Simple, on-chain, transferable.

Or so we thought.

What we discovered after months of development and several attempts to understand the ownership model might save you from a nightmare scenario down the road.

How It’s Supposed to Work

We think that the system suppose to works like this (https://publish.solanamobile.com/):

1. Create your app → Get a publisher NFT
2. Release a new version → Get a new version NFT
3. Want to transfer ownership? → Just send the NFT to another wallet

Sounds straightforward, right? NFTs are transferable by design. That’s Web3 era.

What Actually Happens

Here’s where things get interesting (and problematic).

The NFT Attributes That Matter

When you examine your publisher NFT, you’ll find critical metadata attributes:

• Publisher
• Update Authority

These aren’t just decorative metadata. They’re the keys to your kingdom.

Our Discovery Process

We decided to test the transferability assumption. Here’s what we did:

Step 1: Created our app and received the publisher NFT

Step 2: Attempted to transfer the NFT to a different wallet

Step 3: Discovered that while the NFT technically moved to the new wallet, our app remained stubbornly attached to the original creator wallet

Step 4: Tried editing the NFT metadata using external tools like https://sol-tools.tonyboyle.io/nft-tools/edit-nft to update the publisher and update authority fields

Step 5: Even after successfully modifying the on-chain metadata, the publish.solanamobile.com platform still recognized only the original wallet as the owner.