# Chain support cannot be removed or cleared in bridge contracts

Ondo bridge contracts store chain support as non-empty strings/hashes, so owner cannot clear a chain; zero address still passes checks, letting burnAndCallAxelar burn tokens with no destination mint.

- Payout: Audit contest
- Severity: medium
- Program: Ondo Finance
- Found by: adriro
- Disclosed: 2023-10-12
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-09-ondo#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-ondo%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SourceBridge and DestinationBridge Solidity contracts (Axelar bridge)
**Root cause:** Chain support is keyed by string address representations: SourceBridge stores AddressToString.toString(addr) and checks bytes length != 0, DestinationBridge stores keccak256(abi.encode(addr)) and checks != bytes32(0). Neither can ever be zero, so no delete path exists.
**Steps:**
1. Admin calls `setDestinationChainContractAddress("optimism", destinationAddress)` to enable Optimism.
2. Admin wants to disable: calls `setDestinationChainContractAddress("optimism", address(0))`.
3. Contract stores `AddressToString.toString(address(0))` (42 hex chars), so `bytes(destContract).length == 0` check in burnAndCallAxelar still passes.
4. Messages continue to route; tokens burned on source are not minted on destination.
**How found:** Code review of config setters and their corresponding support checks; noticed string/hash representations can never equal the zero sentinel used for 'unsupported', so no clearing path exists.
**Exploitation:** Owner attempting to disable a chain via address(0) leaves routing active; users calling burnAndCallAxelar burn tokens that are never minted on the destination chain, causing permanent loss. Only mitigation is pausing the contract.
**Insight:** When a mapping's 'unset' sentinel is a zero value but keys/values are derived via hashing or string encoding, verify a delete path exists; address(0) encoded as a string is non-empty and defeats length-based support checks.