# Zeta Observer nodes are not listening to internal TXs, which makes Smart Contract Wallets users' funds locked when making Omnichain calls.

ZetaChain observer nodes only check top-level tx.to for the TSS address, so native-coin omnichain deposits from smart-contract wallets are never credited and funds lock in TSS.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: Al-Qa-qa
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/419
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-02
- Tags: domain:infra domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm technique:source-review vuln:business-logic

**Target:** ZetaClient EVM observer node (evm_client.go observeInTX)
**Root cause:** observeInTX only inspects each block transaction's top-level `to` field for the TSS address and ignores internal transactions, so a contract wallet's low-level call to TSS is never observed.
**Steps:**
1. Deploy a contract wallet with `transferOmnichain` doing `tssAddress.call{value: amount}(to)`
2. Call `transferOmnichain(0.1 tMATIC, 0x8531a5aB847ff5B22D855633C25ED1DA3255247e, <zeta EOA>)` on Mumbai
3. Observe tx.to is the wallet contract, not TSS; observer node ignores the internal call
4. Confirm no ZRC-20 tMATIC is minted to the destination on ZetaChain and funds remain in TSS
**How found:** Code review of observeInTX noticing the check `if *tx.To() == tssAddress` only examines top-level tx recipients; reasoned that contract wallets route value via internal calls, then built a PoC wallet and tested on Mumbai testnet.
**Exploitation:** Any smart-contract wallet (multisig, AA wallet) sending native coin to TSS via low-level call loses funds: the deposit is never credited on ZetaChain and stays locked in the TSS address.
**Insight:** When auditing cross-chain watchers/bridges, check whether deposit detection reads only top-level tx fields (to, logs) versus internal traces; contract wallets and multicall routers hide value transfers in internal calls, causing silent fund lock rather than revert.