# ConnextHandler executeFailedWithUpdatedArgs(...) reentrancy allowedCaller can steal all ConnextHandler tokens Crit/High · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-H04 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description In executeFailedWithUpdatedArgs(...), the allowedCaller can steal all assets available on the ConnextHandler by calling executeFailedWithUpdatedArgs(...) again after the xBundle(...) call. This can be mitigated also by adding the nonReentrant modifier to xBundle(...). ### Recommendation Write txn.executed = true; before the try/catch call and rewrite txn.executed = false if it fails. ### Status Addressed here: [Fujicracy/fuji-v2#621](https://github.com/Fujicracy/fuji-v2/pull/621) --- Related findings: - [Possibility to steal jackpot bypassing restrictions in the `executeDraw()`](https://0xsimao.com/findings/wenwin-possibility-steal-jackpot-bypassing): Wenwin - [Tokens with callbacks may allow malicious attackers to steal the protocol](https://0xsimao.com/findings/clip-finance-i-callbacks-malicious-attackers-steal): Clip Finance Strategies - [A user with a TapiocaOFT allowance >0 could steal all the underlying ERC20 tokens of the owner](https://0xsimao.com/findings/tapioca-dao-allowance-steal-underlying-erc20): Tapioca DAO - [Anyone can steal pool shares from lender group if no-revert-on-failure tokens are used](https://0xsimao.com/findings/teller-finance-steal-shares-revert-failure): Teller Finance