# Router Owner Could Steal All The Funds Within SponsorVault

Router owner self-bridges a large transfer through their own router to collect SponsorVault fee subsidies, draining the vault repeatedly.

- Payout: Audit contest
- Severity: high
- Program: Connext
- Found by: xiaoming90
- Disclosed: 2022-10-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/145
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high technique:chained vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** SponsorVault / BridgeFacet fast-transfer liquidity fee subsidy
**Root cause:** SponsorVault reimburses 50% of liquidity fees to users without distinguishing self-dealing; a router owner can route their own large transfer through their own router and capture the subsidy.
**Steps:**
1. Attacker owns Router A with 1,000,000 oUSDC on Optimism; Router B has only 100 oUSDC.
2. Attacker initiates a 1,000,000 USDC fast transfer from Ethereum to Optimism, sized so only Router A has enough liquidity to be selected by the Sequencer.
3. Router A supplies 950,000 oUSDC on `execute` (5% fee); SponsorVault reimburses 50% of fee = 25,000 oUSDC; attacker receives 975,000 oUSDC.
4. On Nomad message arrival, `BridgeFacet._reconcile` reimburses Router A the full 1,000,000 oUSDC.
5. Net: attacker gains 25,000 USDC, SponsorVault loses 25,000; repeat to drain vault, then withdraw router liquidity.
**How found:** Reasoned about the fee-subsidy economics: since the Sequencer selects routers by liquidity, an attacker controlling a well-funded router can guarantee selection and route their own transfer, making the sponsor reimburse a fee paid to themselves.
**Exploitation:** Attacker uses their own router to service their own large cross-domain transfer, capturing the sponsor's 50% fee subsidy each round; repeated self-transfers siphon the SponsorVault, after which the attacker withdraws router liquidity.
**Escalation:** Repeat large self-transfers across domains to drain the entire SponsorVault balance.
**Insight:** When a protocol subsidizes fees, check whether the payer and payee of the subsidized fee can be the same entity (self-dealing/sybil); sizing a transfer above competitors' liquidity forces selection of your own router.