# Single Error Within SponsorVault Contract Could Cause Entire Cross-Chain Communication To Break Down

A reverting third-party SponsorVault call inside BridgeFacet.execute bricks all cross-chain communication for that domain until the vault is swapped out.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: xiaoming90
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/146
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-14
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos

**Target:** BridgeFacet.execute / ISponsorVault external calls
**Root cause:** BridgeFacet._handleExecuteTransaction unconditionally calls s.sponsorVault.reimburseLiquidityFees and reimburseRelayerFees without try/catch, so any revert in the third-party vault reverts the whole execute transaction.
**Steps:**
1. Deploy/whitelist a SponsorVault on Optimism implementing ISponsorVault.
2. Cause reimburseLiquidityFees or reimburseRelayerFees to revert (vault bug, compromised vault, or malicious vault).
3. Call BridgeFacet.execute on Optimism; the internal _handleExecuteTransaction reverts at the sponsorVault call.
4. All cross-chain messages into Optimism fail until setSponsorVault replaces the vault.
**How found:** Code review of _handleExecuteTransaction: noticed external calls to a third-party SponsorVault are not wrapped in try/catch, making the vault a single point of failure for the domain.
**Exploitation:** A faulty or malicious SponsorVault reverts on reimburseLiquidityFees/reimburseRelayerFees; every execute transaction on that domain then reverts, halting all inbound cross-chain communication (temporary DoS, recoverable via setSponsorVault).
**Insight:** In bridge/relayer contracts, any unguarded external call to a whitelisted third-party module (sponsor vault, relayer, hook) is a domain-wide DoS lever; check whether a revert there can be isolated with try/catch.