# BRC20Factory::burn() could validate the receiver length Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-L03 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description BRC20Factory::burn() does not validate the receiver, which could lead to wasted funds. It's impossible to do a fail safe verification, but at least the length could be checked. ### Recommendation Revert if the length of the receiver is null. ### Status Addressed in [#d5f3226](https://github.com/orangecryptohq/orange-bridge-contract/commit/d5f32267b55c8cde8ea32910492f081074376636).