# Malicious Relayers Could Favor Their Routers

A malicious relayer can swap the sequencer-selected routers in execute calldata for its own router, passing sanity checks and capturing liquidity fees.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: xiaoming90
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/147
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-09
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm technique:chained technique:source-review vuln:business-logic vuln:signature-replay

**Target:** BridgeFacet.execute / _executeSanityChecks cross-chain bridge calldata
**Root cause:** _executeSanityChecks only verifies each router matches its own signature, not that the router set matches what the sequencer originally selected; a relayer can substitute its own router and re-sign the routerHash.
**Steps:**
1. Remove original router from `_args.routers[]` and its signature from `_args.routerSignatures[]` in execute calldata
2. Recompute `routerHash = keccak256(abi.encode(transferId, pathLength))` with pathLength=1
3. Sign routerHash with attacker's own router private key
4. Insert attacker router into `_args.routers[]` and new signature into `_args.routerSignatures[]`
5. Submit modified calldata to destination `BridgeFacet.execute`; sanity check passes since router matches its own signature
6. Attacker router stored in `s.routedTransfers[_transferId]` and provides fast liquidity; later claims fees via `_reconcile`
**How found:** Code review of _executeSanityChecks: noticed it only checks router-to-signature match, not integrity of the router set against the sequencer's original selection, so a relayer owning a router can self-sign a substituted router.
**Exploitation:** Malicious relayer operating a router intercepts the execute calldata, replaces the sequencer-chosen router with its own, re-signs the routerHash, and submits to the destination BridgeFacet. The sanity check passes, the attacker's router supplies fast liquidity and earns the fee, and the original router loses the fee opportunity.
**Insight:** When a relayer forwards calldata that includes a signer-selected set, verify the whole set against the original signer's signature (or bind it into the slow message), not just per-element self-consistency; otherwise any party who can re-sign an element can substitute it.