# XC20Wrapper may lose received token forever if LocalAsset(xc20).mint is reverted indefinitely

XC20Wrapper assumes mint() returns false on failure, but XC20 mint reverts, permanently locking bridged tokens in the gateway when minting fails.

- Payout: Audit contest
- Severity: medium
- Program: Axelar Network
- Found by: Chom
- Disclosed: 2022-10-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-07-axelar#m-02
- Library page: http://bugbountylibrary.com/r/c4%3A2022-07-axelar%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** XC20Wrapper._executeWithToken cross-chain token execution
**Root cause:** The wrapper checks `!LocalAsset(xc20).mint(receiver, amount)` expecting a false return, but XC20 mint reverts on failure (e.g. InvalidAccount, overflow/underflow), so the fallback _safeTransfer is never reached and the whole GMP execution reverts.
**Steps:**
1. Tokens are sent to the gateway before destination-chain message execution.
2. On execution, `_executeWithToken` calls `LocalAsset(xc20).mint(receiver, amount)` inside the `if (xc20 == address(0) || !...)` condition.
3. If mint reverts (e.g. `revert InvalidAccount()` for address(0), or overflow/underflow), the entire `_executeWithToken` reverts.
4. Retrying GMP execution always reverts the same way, so tokens stay locked in the gateway forever.
**How found:** Code reading: noticed the wrapper relies on the ERC20 false-return convention for mint failure, while the actual ERC20 implementation reverts (judge confirmed `revert InvalidAccount()` and overflow/underflow paths), so the fallback transfer branch is unreachable on failure.
**Exploitation:** Not an active attack; a failure-mode bug. Any mint revert (invalid account, overflow) bricks the message execution path, leaving bridged tokens stranded in the gateway with no recovery route.
**Insight:** When a contract branches on a boolean return from an external call, check the actual implementation: many tokens revert instead of returning false, making the fallback branch dead code and turning recoverable failures into permanent lockups.