# _crossTransfer(...) should revert if users specify routerByDomain[destDomain] as destination Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L05 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description This scenario only happens if the router in the destDomain has the same address as the router in the destDomain. Else, the beneficiary check will fail. _crossTransfer(...) enables users to bridge assets to any destination, without calldata. If users want to send assets to the router on the other chain, they might select _crossTransfer(...) instead of _crossTransferWithCalldata(...), which would cause them to lose their funds. ### Recommendation Add the check if (receiver) == routerByDomain[destDomain]) revert(); in the crossTransfer() call. ### Status Addressed here: [Fujicracy/fuji-v2#651](https://github.com/Fujicracy/fuji-v2/pull/651) --- Related findings: - [Exercise option cross chain message in the (m)TapiocaOFT will always revert in the destination, losing debited funds in the source chain](https://0xsimao.com/findings/tapioca-dao-exercise-revert-losing-debited): Tapioca DAO - [Metadata is not set in Cap, which is required by the inherited Router to specify gas limit to the mailbox](https://0xsimao.com/findings/mitosis-metadata-inherited-gas-mailbox): Mitosis - [Send should revert if the gas limit has not been set for a destination chain (peer)](https://0xsimao.com/findings/metazero-i-revert-gas-destination-peer): MetaZero Omnichain NFTs - [Notional difference in AmmRouter:removeLiquidty() may revert in certain cases](https://0xsimao.com/findings/nftperp-ii-notional-difference-liquidty-revert): Nftperp Matching Engine