# Funds from reverted transaction may be lost/locked 

If ZetaConnectorNonEth.onRevert reverts on the source chain, the CCTX is aborted and burned user funds are never minted back, locking them permanently.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: deliriusz
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/498
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:business-logic

**Target:** ZetaConnector.non-eth onRevert / crosschain keeper vote-outbound-tx
**Root cause:** When onRevert reverts (e.g. maxSupply exceeded or onZetaRevert callback reverts), the keeper marks the CCTX Aborted and never retries; only the Connector can mint, so burned funds cannot be returned.
**Steps:**
1. User calls ZetaConnectorNonEth.send() creating a CCTX with 10k ZRC20.
2. Destination-chain execution fails; CCTX moves to PendingRevert.
3. TSS calls onRevert() on source chain; it reverts (maxSupply check or onZetaRevert callback).
4. Keeper sets CCTX to Aborted in keeper_cross_chain_tx_vote_outbound_tx.go and stops processing.
5. Funds burned on source chain are never minted back to sender.
**How found:** Code reading of the revert flow in keeper_cross_chain_tx_vote_outbound_tx.go and ZetaConnector.non-eth.sol, noting the Aborted terminal state and that only the Connector can mint.
**Exploitation:** Not attacker-driven; triggered when TSS lowers maxSupply below totalSupply+remaining or the sender's onZetaRevert callback reverts, causing permanent loss of the user's burned funds.
**Insight:** In cross-chain revert designs, check whether the failure path of the revert handler is terminal (Aborted) with no retry or manual redemption; also check admin-settable caps (maxSupply) that can make the mint branch revert.