# Users can claim tokens in ConnextRouter by calling xReceive(...) directly Crit/High · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-M08 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description The ConnextRouter allows anyone to call xReceive(...) and the amount of assets the user provided is the [balance of the contract](https://github.com/Fujicracy/fuji-v2/blob/v0.1.0/packages/protocol/src/routers/ConnextRouter.sol#L148). Thus, users can use this functionality to sweep any existing funds into their wallets. In fact, this should also happen when a xReceive(...) call fails at this.xBundleConnext(...), and the balance, including the existing tokens, get attributed to the user. It should not be a likely event given that there are checks to ensure that the ConnextRouter does not end up with funds after xBundle(...) calls. Still, given that the BaseRouter has a sweepTokens(...) function, this might lead to a false sense of security. ### Recommendation Only let a permissioned address call xReceive(...) (should be the xConnect address). Additionally, instead of sending the balance in the ConnextRouter if this.xBundleConnext(actions, args, beforeSlipped) fails, send the amount. ### Status Addressed here: [Fujicracy/fuji-v2#639](https://github.com/Fujicracy/fuji-v2/pull/639) --- Related findings: - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook): PoolTogether Prize Layer - [Inconsistent sequencer unexpected delay in DelayBuffer may harm users calling forceInclusion()](https://0xsimao.com/findings/arbitrum-bold-sequencer-unexpected-force-inclusion): Arbitrum Bold - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract