When Your Bridge Signature Doesn’t Sign What You Think It Signs

A deep dive into incomplete ECDSA hash binding in cross-chain bridge authorization