# User can redirect fees by using a proxy contract

Turnstile CSR gas refunds go to tx recipient, so users route calls through their own proxy contract to capture fees meant for the app.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: Ruhum
- Disclosed: 2023-03-31
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-canto-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-canto%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Turnstile.sol CSR fee-refund registration and evm_hooks PostTxProcessing
**Root cause:** Fee refund is credited to msg.To (tx recipient) rather than the contract actually consuming gas, and registration is permissionless, so an intermediary proxy becomes the recipient.
**Steps:**
1. Register a proxy contract address via Turnstile.register(_recipient) (permissionless, onlyUnregistered).
2. Have users call target contract X through proxy X' so msg.To == X'.
3. PostTxProcessing in x/csr/keeper/evm_hooks.go credits the refund to X' instead of X.
4. X' retains or redistributes the refund, diverting fees from the real application.
**How found:** Code reading of Turnstile.register and the CSR PostTxProcessing hook: noticed refunds keyed to msg.To and registration open to anyone, implying an intermediary contract captures the refund.
**Exploitation:** Deploy a wrapper/proxy contract that forwards calls to a high-usage target; since the proxy is the tx recipient it receives the CSR gas refund, which the attacker keeps or shares with callers to incentivize routing through it.
**Escalation:** Could set up proxies for popular high-usage contracts and rebate a percentage of captured refunds to callers, scaling fee diversion.
**Insight:** When a protocol rebates gas/fees based on tx recipient, check whether an attacker-controlled intermediary contract can become the recipient and siphon the rebate from the intended app.