# When DecentBridgeExecutor.execute fails, funds will be sent to a random address

DecentEthRouter encodes msg.sender (source-chain adapter) as refund 'from'; on destination-chain call failure, refunds go to a wrong/nonexistent address, losing funds.

- Payout: Contest reward
- Severity: high
- Program: Decent
- Credited: DadeKuma
- Disclosed: 2024-03-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-decent-findings/issues/436
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** DecentEthRouter / DecentBridgeExecutor cross-chain bridge
**Root cause:** The cross-chain payload's 'from' field is set to msg.sender (the source-chain DecentBridgeAdapter), not the user's refund address; on destination-chain execution failure, _executeEth/_executeWeth refund to this wrong address.
**Steps:**
1. UTB.bridgeAndExecute -> DecentBridgeAdapter.bridge -> DecentEthRouter.bridgeWithPayload
2. _getCallParams encodes payload with msg.sender (source-chain adapter) as 'from'
3. dcntEth.sendAndCall delivers payload to destination DecentEthRouter.onOFTReceived
4. onOFTReceived decodes _from = source-chain adapter address, calls executor.execute(_from, _to, ...)
5. Target call fails; _executeEth/_executeWeth does payable(from).transfer(amount) to the wrong address
6. Verify deployed addresses differ across chains (arbitrum vs optimism JSONs), so refund is lost
**How found:** Traced the payload construction in _getCallParams and noticed msg.sender is used as 'from'; followed it through onOFTReceived to the executor refund path and confirmed deployed addresses differ across chains (no CREATE2).
**Exploitation:** Any cross-chain call whose destination target call reverts triggers the refund path; since 'from' is the source-chain adapter address (different address on destination chain, no CREATE2), the refunded ETH/WETH is permanently lost.
**Insight:** In cross-chain bridges, trace every address field end-to-end across chains; msg.sender on the source chain is not a valid recipient on the destination chain unless deterministic deployment (CREATE2) guarantees identical addresses.