# Attacker can block LayerZero channel

RedemptionReceiver lacked LayerZero non-blocking handling, so any caller could send a reverting message that permanently blocks the FTM-Optimism channel.

- Payout: Contest reward
- Severity: high
- Program: Velodrome Finance
- Credited: Ruhum
- Disclosed: 2022-08-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-05-velodrome-findings/issues/83
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-velodrome%3AH-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:chained technique:source-review vuln:access-control vuln:dos

**Target:** LayerZero cross-chain RedemptionReceiver contract (FTM to Optimism)
**Root cause:** RedemptionReceiver implements the blocking LzApp pattern: a failed destination message is stored and blocks all subsequent messages from that source until retried successfully. It lacks forceResumeReceive/non-blocking handling and does not restrict trusted remote senders.
**Steps:**
1. Read LayerZero docs: failed destination tx blocks the per-source-address message queue until retried to success.
2. Inspect RedemptionReceiver.sol L72-105: no non-blocking pattern, no forceResumeReceive.
3. Attacker builds their own LZApp and sends a message to the receiver that is guaranteed to revert on execution.
4. Stored failed message blocks all future messages from that srcUA to the receiver; channel unusable.
**How found:** Compared the in-scope receiver against LayerZero's documented message-ordering behavior and the NonblockingLzApp reference implementation; noticed the contract used the default blocking pattern with no exception handling or trusted-sender check.
**Exploitation:** Attacker sends a crafted cross-chain message from a self-built LZApp that reverts in the receiver; the stored failed message blocks the queue indefinitely since no forceResumeReceive exists to clear it, denying redemption functionality.
**Insight:** When a protocol integrates a messaging layer, check whether it uses the blocking or non-blocking base class and whether trusted remotes are enforced; a single reverting message from any permitted sender can permanently brick a queue with no resume function.