# Routers are not Enforced to Repay AAVE Portal Loan

Connext credits a router's balance for an AAVE Portal loan even when repayment fails, letting the router withdraw funds and stick Connext with the debt.

- Payout: Audit contest
- Severity: high
- Program: Connext
- Found by: xiaoming90
- Disclosed: 2022-10-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/143
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BridgeFacet._reconcileProcessPortal / AAVE Portal repayment logic
**Root cause:** When the swap or AavaPool.backUnbacked repayment fails, _reconcileProcessPortal returns the full _amount instead of zero, so the router is credited the borrowed amount despite no repayment occurring.
**Steps:**
1. Alice bridges 1,000,000 DAI Ethereum->Polygon; routers lack liquidity so AAVE Portal is used
2. Bob's router is selected to take credit risk; Connext borrows 1,000,000 DAI from AAVE Portal and pays Alice
3. Nomad message arrives, BridgeFacet.handle -> _reconcile -> _reconcileProcessPortal
4. Swap or `AavaPool.backUnbacked` fails; code sets `amountIn = 0` and returns `_amount - amountIn` = full amount
5. At L603 `toDistribute` = amount; at L611 Bob's router balance is increased by 1,000,000 DAI
6. Bob withdraws router liquidity instead of calling `repayAavePortal`; Connext still owes AAVE 1,000,000 DAI
**How found:** Code review of _reconcileProcessPortal error paths: noticed failure branches return the full _amount rather than zero, and traced that return value into the router balance credit at L603/L611.
**Exploitation:** A whitelisted router selected to back an AAVE Portal loan waits for the reconcile repayment to fail (swap or backUnbacked revert), receives the full bridged amount credited to its router balance, then withdraws liquidity and never calls repayAavePortal out-of-band, leaving Connext holding the AAVE debt.
**Insight:** In bridge/portal reconcile flows, audit every error-handling branch of the repayment path: a failed external call that returns the nominal amount instead of zero silently converts a repayment failure into a credit to the party who owes the debt.