# _msgSender() is mixed with msg.sender Low/Info · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-L06 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description The code is using OpenZeppelin's Context contract which is intended to allow meta-transactions. It works by using a call to _msgSender() instead of querying msg.sender directly, because the method allows those special transactions. The problem is that the bridge adapters use msg.sender directly instead of _msgSender(). While this doesn't significantly impact the functions [called](https://github.com/0x73696d616f/evm-eol-3s-audit/blob/b545f6724c3f0b5eebea72c652d7f9728f1627f0/src/helpers/ccdm/CCDMHost.sol#L247) from CCDMHost, as meta-transactions aren't needed there, it causes issues for users who call the adapters directly. ### Recommendation Change the code to use _msgSender() instead of msg.sender. ### Status Addressed in [#445f850](https://github.com/mitosis-org/evm/pull/181/commits/445f850262af1f01700efd9756f5e4ea212381e5). --- Related findings: - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems): Autonomint - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [Incorrect `RefundClaim` event due to deleting `idoConfig.accountPositions[msg.sender]`](https://0xsimao.com/findings/blast-ido-pools-refund-deleting-config-positions): Blast IDO Pools - [Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-othan-stuck-increasing-avg): Exactly Protocol Update - Staking Contract