Skip to content
Request an audit

‹ Findings database

ConnextHandler executeFailedWithUpdatedArgs(...) reentrancy allowedCaller can steal all ConnextHandler tokens

Crit/HighFuji Finance audit·Three Sigma·Lending aggregator·6th May, 20233S-FUJI-H04

Description

In executeFailedWithUpdatedArgs(...), the allowedCaller can steal all assets available on the ConnextHandler by calling executeFailedWithUpdatedArgs(...) again after the xBundle(...) call. This can be mitigated also by adding the nonReentrant modifier to xBundle(...).

Recommendation

Write txn.executed = true; before the try/catch call and rewrite txn.executed = false if it fails.

Status

Addressed here: Fujicracy/fuji-v2#621

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests