Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Connext — routers pay signed amount on `execute`, credited only `bridgedAmt` on reconcile

1. Origin xcall swaps adopted → local; only bridgedAmt is messaged. 2. Destination execute (fast path) debits routers from the user-signed _args.amount. 3. _reconcile credits routers only action.amnt() (= bridgedAmt). 4. HARM: signed 100, bridged 90 → router net loss ≈ 9.95 after liq fee (debit 99.…

Jun 2022•Other•bridge•3 min read

Chain

Other

Category

bridge

Date

Jun 2022

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 25133-h-04-in-execute-the-amount-routers-pay-is-what-user-signed-b. Standalone Foundry PoC and full write-up: 25133-h-04-in-execute-the-amount-routers-pay-is-what-user-signed-b_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/bridge/amount-mismatch · vuln/logic/wrong-condition · genome: wrong-condition · fot-slippage · direct-drain

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/25133-h-04-in-execute-the-amount-routers-pay-is-what-user-signed-b_exp.sol.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/bridge · genome: wrong-condition · specific-token-type · fot-slippage · direct-drain

Key info#

ImpactHIGH — fast-path routers systematically lose the origin-swap slippage gap
ProtocolConnext
Vulnerable codeBridgeFacet._handleExecuteLiquidity debits routers from _args.amount
Bug classSigned vs bridged amount mismatch across execute / reconcile
FindingCode4rena 2022-06-connext · H-04 · #25133
Reportcode4rena.com/reports/2022-06-connext
SourceAuditVault
StatusResolved (sponsor). Reproduced as standalone local PoC.
Compiler^0.8.24 (PoC)

TL;DR#

  1. Origin xcall swaps adopted → local; only bridgedAmt is messaged.
  2. Destination execute (fast path) debits routers from the user-signed _args.amount.
  3. _reconcile credits routers only action.amnt() (= bridgedAmt).
  4. HARM: signed 100, bridged 90 → router net loss ≈ 9.95 after liq fee (debit 99.95, credit 90).

The vulnerable code#

SOLIDITY
// _handleExecuteLiquidity (fast path)
toSwap = _getFastTransferAmount(_args.amount, feeNum, feeDen);
uint256 routerAmount = toSwap / pathLen;
for (...) {
    routerBalances[_args.routers[i]][_args.local] -= routerAmount; // @> VULN: uses signed amount
}
// reconcile later: credit bridgedAmt only

Fix: debit (and identify) transfers using the bridged/message amount, not the pre-slippage signed amount.

Root cause#

ExecuteArgs carries the amount the user signed on origin. After swapToLocalAssetIfNeeded, the nomad message amount can be smaller (swap slippage / deflationary transfer). Fast liquidity uses the larger figure; reconciliation uses the smaller one — routers fund the difference.

Preconditions#

  • Origin path incurs slippage (or fee-on-transfer) so bridgedAmt < signed amount.
  • Destination uses fast-path routers (not pure slow reconcile-first).

Attack walkthrough#

  1. xcall with signed 100; swap yields bridged 90.
  2. Fast execute debits router ≈ 99.95 local.
  3. reconcile credits 90.
  4. HARM: router inventory down by ≈ 9.95.

Diagrams#

sequenceDiagram participant User participant Origin as Origin xcall participant Router participant Dest as Destination BridgeFacet User->>Origin: xcall signed=100 Origin->>Origin: swap to local bridgedAmt=90 Origin-->>Dest: message amount=90 Dest->>Router: execute debit from signed 100 Note over Router: balance -= ~99.95 Dest->>Router: reconcile credit 90 Note over Router: net loss ~9.95

Impact#

Routers providing fast liquidity on low-liquidity / high-slippage assets lose inventory equal to the origin slippage gap. Can be abused to drain router balances on thin markets.

How to reproduce#

BASH
cd evm-hack-registry/25133-h-04-in-execute-the-amount-routers-pay-is-what-user-signed-b_exp
forge test -vvv

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.