# User funds can be lost in favor of Zeta protocol during a CCTX due to contracts being paused

ZetaConnector's onRevert is gated by whenNotPaused while onReceive is not, so a failed inbound CCTX during a pause can never be refunded, stranding user funds in the protocol.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: dontonka
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/191
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ZetaConnectorEth.sol / ZetaConnectorNonEth.sol cross-chain connector contracts
**Root cause:** onRevert is gated with whenNotPaused but onReceive is not; during an emergency pause a revert in onReceive triggers the refund mechanism which calls onRevert on the originating chain, where the paused connector reverts, aborting the CCTX.
**Steps:**
1. Deploy scenario: BSC and ETH ZetaConnector contracts both paused via pause().
2. User's CCTX already emitted ZetaSent on BSC and is pending observer processing.
3. Observer calls onReceive on ETH connector (not paused-gated); onZetaMessage reverts.
4. CCTX moves to PendingRevert; zetaclient builds revert tx calling onRevert on BSC connector.
5. onRevert reverts due to `whenNotPaused` modifier; CCTX status becomes Aborted.
6. User funds remain in Zeta protocol, never refunded.
**How found:** Code reading of the connector contracts' pause gating: noticed onReceive lacks whenNotPaused while onRevert has it, then traced the whitepaper CCTX refund flow to see the revert path fails under pause.
**Exploitation:** No attacker action; triggered by normal emergency pause operations (e.g. TSS migration) combined with a failing onReceive, causing refund path to revert and funds to be trapped.
**Insight:** When auditing pause/emergency mechanisms, check that every path needed to unwind in-flight state (refunds, reverts, cancellations) is exempt from the pause gate; asymmetric gating between forward and reverse flows traps funds.