# Cross-domain action clears local balance

Cross-chain repay, burn or settle paths that mutate one ledger without gating on the domain flag

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-17. Updated 2026-10-25._

## How it works
A contract keeps two ledgers: one for the local chain/domain and one for the remote side. A repay, burn, or settle path is written to run on both, but the code that clears or reduces the local balance is not gated on which domain the action actually came from. The assumption that breaks is "this cleanup block only runs for the path it was written for." When a cross-domain action reaches it, it wipes or skips state that belongs to the other ledger, so recorded balances drift from reality: debt vanishes, or funds are burned with nothing to restore them.

## Where it shows up
- Repay/borrow functions with a `_isSameChain` (or similar) flag where a shared block mutates storage unconditionally [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-16.md)
- Bridge settlement modes with different orderings: burn-then-unlock vs lock-then-mint-then-burn [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-07.md)
- Cross-chain deposit flows where an approval is made but the matching lock call is missing [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md)
- NatSpec or docstrings listing ordered steps the code does not fully perform [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md)

## How to review
For every function that takes a same-chain/cross-chain flag, list each storage write and confirm it is gated on that flag; the invariant is that a cross-domain action never mutates the other domain's ledger. For bridges, trace the ordering: source state must not be irreversibly destroyed before destination confirmation, and a failure callback must exist to restore it. Diff documented steps against code: a missing state-mutating step after an approval (the lock call) leaves the mint unbacked [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md).

## Variants seen
- Ungated same-chain balance update inside a cross-chain repay [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-16.md)
- BurnUnlock burns source tokens before destination unlock, no restore callback [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-07.md)
- Approval without the lockAssets call, minting unbacked positions [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md)

## Why fixes fail
E3 shows the failure mode directly: one settlement mode (MintBurn) has a success callback safety net while the sibling mode (BurnUnlock) does not, so fixing one path leaves the other lossy.

## Impact and severity
Critical. Evidence includes unbacked mints draining other depositors [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md), erased debt causing lender loss [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-16.md), and permanent two-chain fund loss [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-07.md). Severity rises when the bad state is irreversible or when one path's fix leaves a sibling path exposed.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-16.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AM-07.md