# fastTrackProposalExecution doesn’t check intendedRecipient

fastTrackProposalExecution skips the intendedRecipient check that queueProposal enforces, letting the guardian execute Wormhole VAAs addressed to other contracts/chains.

- Payout: Audit contest
- Severity: medium
- Program: Moonwell
- Found by: immeas
- Disclosed: 2023-10-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-07-moonwell#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-moonwell%3AM-07
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass

**Target:** TemporalGovernor.sol governance contract (Wormhole VAA execution)
**Root cause:** queueProposal requires intendedRecipient == address(this), but _executeProposal (used by fastTrackProposalExecution) omits that check, so VAAs multicast to other chains/contracts are accepted.
**Steps:**
1. Note Wormhole VAAs are multicast: no destination chain/address in the signed payload.
2. queueProposal enforces `require(intendedRecipient == address(this), "TemporalGovernor: Incorrect destination")`.
3. fastTrackProposalExecution calls `_executeProposal(VAA, true)` directly, bypassing queueProposal.
4. Craft VAA with wrong intendedRecipient but trusted sender and a target address that exists on this chain.
5. Call `governor.fastTrackProposalExecution(VAA)`; it executes instead of reverting.
**How found:** Compared the destination check in queueProposal against the fastTrack path and noticed _executeProposal lacked the same intendedRecipient validation; confirmed by copying testProposeFailsIncorrectDestination and swapping queueProposal for fastTrackProposalExecution.
**Exploitation:** Guardian (owner) submits a VAA whose intendedRecipient is another contract/chain but whose trusted sender and target align on this chain; _executeProposal performs the .call without contract-existence checks, executing arbitrary governance commands.
**Escalation:** Only one target address must line up across chains since .call doesn't verify contract existence; unaligned addresses typically don't exist so calls succeed.
**Insight:** When a contract has a normal and an emergency/fast-track path into the same internal executor, diff the guards each path applies — emergency paths often drop destination/recipient checks that the normal path enforces.