# Router Owner Could Be Rugged By Admin

Connext admin removing a router zeroes its owner mapping, so getRouterOwner falls back to the router address and the real owner can never withdraw stuck liquidity.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: xiaoming90
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/150
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-10
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** RoutersFacet router permissioning and liquidity withdrawal
**Root cause:** removeRouter deletes routerOwners[router], and getRouterOwner falls back to the router address when owner is zero, so the original owner no longer matches msg.sender in removeRouterLiquidityFor.
**Steps:**
1. Admin calls `RoutersFacet.removeRouter(aliceRouter)`, setting approvedRouters=false and routerOwners[aliceRouter]=address(0)
2. Alice calls `removeRouterLiquidityFor(amount, local, to, aliceRouter)`
3. Check `msg.sender != getRouterOwner(_router)` fails because getRouterOwner returns aliceRouter (owner==0 fallback)
4. Call reverts with RoutersFacet__removeRouterLiquidityFor_notOwner every time; liquidity remains stuck
**How found:** Code reading of removeRouter's mapping deletions and tracing how getRouterOwner's zero-owner fallback interacts with the removeRouterLiquidityFor owner check.
**Exploitation:** Requires the privileged Connext admin (EOA) to revoke a router; the owner then cannot withdraw their liquidity, and a compromised admin could revoke all routers and upgrade the facet to sweep funds.
**Escalation:** Compromised admin removes all routers, freezing all liquidity, then upgrades RouterFacet to add an arbitrary-withdraw function.
**Insight:** When a permission check uses a getter with a fallback (owner==0 returns the resource address), audit every path that zeroes the underlying mapping — deletion can silently change who passes the check.