# S2S Transfer from the origin schain to another schain with automatic deploy disabled can cause funds to be frozen

S2S ERC20 transfer to a schain with automaticDeploy disabled locks user tokens on the origin schain because the target-side clone creation reverts.

- Payout: Audit contest
- Severity: medium
- Program: SKALE
- Found by: WatchPug
- Disclosed: 2022-11-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-skale-findings/issues/59
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-skale%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:misconfiguration

**Target:** TokenManagerERC20 bridge contracts (origin and target schain)
**Root cause:** Origin schain locks tokens and emits a transfer message without checking whether the target schain has automaticDeploy enabled; target-side _sendERC20 requires automaticDeploy when no clone exists, so the inbound message reverts and locked tokens are stranded.
**Steps:**
1. On origin schain call `TokenManagerERC20.transferToSchainERC20()` for a main-chain-native token not yet mapped on target.
2. Origin executes `_exit` -> `_receiveERC20`, locks `amount` via `transferFrom`, and encodes a transfer message.
3. Target schain processes `postMessage()` -> `_sendERC20()`; `clonesErc20[fromChainHash][token]` is address(0).
4. Target hits `require(automaticDeploy, "Automatic deploy is disabled")` and reverts.
5. User's tokens remain locked in origin TokenManager with no successful mint on target.
**How found:** Code reading of the origin-side transfer path versus the target-side message handler, noticing the origin never validates target schain's automaticDeploy configuration while the target requires it to create the clone.
**Exploitation:** No attacker action; a user performing a legitimate S2S transfer to a schain configured with automaticDeploy=false permanently locks their tokens in the origin TokenManager contract.
**Insight:** In cross-chain bridges, compare the preconditions enforced on the source side against those enforced on the destination side; any destination-only require (like automaticDeploy) that can revert after source-side funds are locked is a fund-freezing vector.