THORWallet — Bridge path bypasses TITN transfer lock — send to any address

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri. Standalone Foundry PoC and full write-up: 55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri_exp in the evm-hack-registry mirror.

Vulnerability classes: bridge-message-validation, access-roles, multi-tx

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri_exp.sol.

Key info#


Impact	HIGH — Transfer-lock invariant broken: bridge credits tokens to arbitrary recipient
Protocol	THORWallet
Vulnerable code	`Titn` (see `@>` in synthetic)
Finding	Code4rena · #55397
Report	https://code4rena.com/reports/2025-02-thorwallet
Source	AuditVault
Status	Audit finding — reproduced as a standalone local PoC
Compiler	`^0.8.24`

TL;DR#

Bridge path bypasses TITN transfer lock — send to any address. Harm demonstrated: Transfer-lock invariant broken: bridge credits tokens to arbitrary recipient.

The vulnerable code#

See test/55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

Deploy the reduced vulnerable system (CREATE order: Titn, BridgedUser).
Seed the preconditions from the finding (approvals, balances, whitelist).
Execute the attack path; the @> line runs.
require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Transfer-lock invariant broken: bridge credits tokens to arb"]

Impact#

Transfer-lock invariant broken: bridge credits tokens to arbitrary recipient

Taxonomy#

bridge-message-validation, access-roles, multi-tx

Sources#

AuditVault finding
Code4rena report
Reduced from: code-423n4/2025-02-thorwallet contracts/Titn.sol _credit / transfer lock

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri_exp (evm-hack-registry mirror).
AuditVault finding: 55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync