<!-- canonical: https://0xsimao.com/findings/metazero-i-nfts-wallets-having-addresses -->

# Lost nfts due to smart wallets having different addresses on different chains

Crit/High · Three Sigma · Omnichain RWA tokenisation · 27th January, 2024

Finding 3S-MetaZero-H02 of the MetaZero Omnichain NFTs security review.

- Protocol: https://metazero.gg/
- Report: /reports/metazero-i
- Source: https://cdn.sanity.io/files/qoqld077/production/1b1ab4ff365756fe1d86767f1e06744407570f5a.pdf

---

### Description

[send()](https://github.com/threesigmaxyz/metazero-issues-external/blob/master/src/ONFTV2-721C.sol#L98) sends the tokens to the same address that called the function. Some smart contract
wallets may have different addresses on different chains (or even chains with different
address generation).

### Recommendation

Let the user specify a destination address to send the nfts to.

### Status

Addressed in 5f138f1.

---

Related findings:

- [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share): Fuji Finance
- [Reusing the same rho and pubKey in different deposits leads to lost tokens](https://0xsimao.com/findings/singularity-reusing-rho-pub-deposits): Singularity
