# executeFailedWithUpdatedArgs(...) shouldn't be able to change beneficiary Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L06 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description When the ConnextRouter message fails, it records the message in the ConnextHandler and sends it the funds. In the ConnextHandler, it's possible to change the actions and arguments of a failed tx in executeFailedWithUpdatedArgs(...). Thus, it's possible to change the beneficiary, which would leave room for attacks to steal assets. ### Recommendation Check the beneficiary of the first action to match the previous beneficiary. ### Status Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, as indicated the severity of this issue is low. The call to execute a failed transfer is permissioned and it's in the team's best interest to resolve failed transfers ethically. During Q3-2023 the team will be working on general optimizations/improvements on the router contracts in which this fix will be implemented.