# All bridged funds will be lost for the users using the account abstraction wallet

SourceBridge encodes msg.sender as the destination recipient, so account-abstraction wallet users bridging assets get tokens minted to an address they don't control on the destination chain.

- Payout: Audit contest
- Severity: medium
- Program: Ondo Finance
- Found by: nirlin
- Disclosed: 2023-10-12
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-09-ondo#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-ondo%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SourceBridge/DestinationBridge cross-chain bridge (Axelar)
**Root cause:** burnAndCallAxelar builds the payload with msg.sender as the destination recipient, assuming identical addresses across EVM chains; account-abstraction wallets have different addresses per chain.
**Steps:**
1. User with an account-abstraction wallet calls burnAndCallAxelar on SourceBridge
2. Payload is built as `abi.encode(VERSION, msg.sender, amount, nonce++)`
3. _payGasAndCallCotract forwards payload to Axelar gateway via callContract
4. Axelar node calls DestinationBridge._execute with the payload
5. Tokens are minted to srcSender (the source-chain address), which the user does not own on the destination chain
**How found:** Code review of the payload construction in burnAndCallAxelar, noticing msg.sender is reused as the destination recipient and reasoning about account-abstraction wallets having per-chain addresses.
**Exploitation:** Not an attack; a user-initiated bridge to a destination address they don't control results in permanently lost minted tokens.
**Insight:** In cross-chain bridges, never assume msg.sender maps to a controllable address on the destination chain; account-abstraction and counterfactual wallets break address symmetry, so always let the user specify the recipient.