# Mismatching calldata in _crossTransferWithCalldata(...) and xReceive(...) in ConnextRouter Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-N07 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description Users can bridge assets by inserting an Action.XTransferWithCall action, with calldata specified in the args field. The calldata in _crossTransferWithCalldata(...) and _getBeneficiaryFromCalldata(...) is decoded as : ```solidity (Action[] memory actions, bytes[] memory args,) = abi.decode(callData, (Action[], bytes[], uint256)); ``` Whereas in xReceive(...), it lacks the last uint256: ```solidity (Action[] memory actions, bytes[] memory args) = abi.decode(callData, (Action[], bytes[])); ``` ### Recommendation Remove the last uint256 parameter from being decoded, as it is not being used. ### POC https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/EncodingCalldata.t.sol#L12 ### Status Addressed here: [Fujicracy/fuji-v2#651](https://github.com/Fujicracy/fuji-v2/pull/651) --- Related findings: - [`GlobalVariables::oftOrCollateralReceiveFromOtherChains()` always charges twice the collateral on `COLLATERAL_TRANSFER`, which is not needed](https://0xsimao.com/findings/autonomint-collateral-charges-transfer-needed): Autonomint