From the docs:
The important feature of Receipts is that they don’t contain a signature. All receipts are valid by default. This means if a chunk receives a Receipt that contains token transfer, it will deposit tokens without a need to verify the source of the transfer, because all receipts are considered valid.
If receipts are the primary method for communicating state changes across the network (from one shard to another), wouldn't it be possible for a man-in-the-middle attack to inject invalid receipts and so force unsigned transactions to be applied to the blockchain?
Or am I missing something?
That would be impossible because all receipts are merklized and the merkle root is contained in the chunk header. Before applying a chunk, the validator first verify that the receipt merkle root matches the one the in chunk header. If it doesn't match then the chunk is invalid and will be challenged.