# Repaying AAVE Loan in _local rather than adopted asset

Connext PortalFacet repays AAVE loans using the local asset instead of the swapped adopted asset, breaking the liquidity portal when denominations differ.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: cloudjunky
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/103
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-18
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PortalFacet.sol repayAavePortal / _backLoan
**Root cause:** repayAavePortal swaps local to adopted asset via swapFromLocalAssetIfNeededForExactOut but discards the returned `adopted` address and passes `_local` to _backLoan, repaying AAVE with the wrong token.
**Steps:**
1. Call `repayAavePortal()` with a `_local` asset differing from the adopted asset backing the loan.
2. Observe `swapFromLocalAssetIfNeededForExactOut(_local, totalAmount, _maxIn)` returns `(success, amountIn, adopted)`.
3. Note router balance decremented by `amountIn` in `_local`, but `_backLoan(_local, ...)` is called with `_local` instead of `adopted`.
4. AAVE receives the local token rather than the adopted token, leaving debt mis-repaid.
**How found:** Code reading: noticed the `adopted` return value from the swap was an unused local variable while the comment explicitly stated the loan must be repaid in the adopted asset, then traced `_backLoan` receiving `_local`.
**Exploitation:** Whitelisted routers repaying AAVE debt could repay with a token of different/higher denomination (e.g. USDC debt paid with ETH/DAI), breaking the liquidity portal until a protocol upgrade restores solvency.
**Insight:** When a swap helper returns a new asset address, verify every downstream call uses that returned address rather than the original input; unused return variables next to comments about asset conversion are a strong smell.