# _handleExecuteTransaction may not working correctly on fee-on-transfer tokens. Moreover, if it is failed, fund may be locked forever.

Connext Executor mishandles fee-on-transfer tokens: double fee applied, allowance set to full amount, and failure path reverts, locking funds.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: Chom
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/196
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BridgeFacet._handleExecuteTransaction / Executor contract
**Root cause:** Executor receives amount minus transfer fee but increases allowance and attempts recovery transfer for the full amount, so the target call and the failure-handling transfer both revert.
**Steps:**
1. Relayer submits message to `_handleExecuteTransaction` transferring 100 fee-on-transfer tokens (e.g. Safemoon, 10% fee).
2. `AssetLogic.transferAssetFromContract` sends 100 tokens to Executor; Executor holds 90 after fee.
3. Executor calls `safeIncreaseAllowance(_args.to, 100)` for the target contract.
4. Target contract pulls 100 tokens but Executor only has 90, so call fails.
5. `_handleFailure` attempts `safeTransfer(_recovery, 100)` with only 90 balance, reverting; funds locked.
**How found:** Code review of the execute flow: noticed the asset is transferred into the Executor before the call, then allowance is granted for the full `_args.amount` rather than the actual received balance, and the failure handler likewise transfers the full amount.
**Exploitation:** Any bridge transfer of a fee-on-transfer token to a destination with a contract call payload fails; the recovery path also reverts because it tries to move the full pre-fee amount, permanently locking the bridged funds in the Executor.
**Insight:** When a contract receives tokens then grants allowance or refunds, always use the actual balance delta (balanceOf after minus before) rather than the nominal amount; fee-on-transfer tokens break any accounting that assumes 1:1 receipt.