# Dual transaction nature of composed message transfer allows anyone to steal user funds

ASDRouter's permissionless lzCompose lets anyone front-run the executor to redeem whitelisted OFTs deposited for a victim, stealing their funds.

- Payout: Audit contest
- Severity: high
- Program: Canto
- Found by: 0xTheC0der
- Disclosed: 2024-05-03
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-03-canto#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window vuln:access-control vuln:business-logic

**Target:** ASDRouter contract lzCompose on Canto (LayerZero V2 OFT composed message)
**Root cause:** Composed message transfer is non-atomic: OFTs arrive in one tx, lzCompose executes in a separate permissionless tx with no msg.sender constraint, so anyone can consume the deposited OFTs.
**Steps:**
1. Monitor ASDRouter for incoming whitelisted USDC-like OFTs delivered via LayerZero endpoint.
2. Before the executor calls lzCompose, craft a call to ASDRouter.lzCompose(...) referencing the pending composed message.
3. Invoke lzCompose as attacker; it redeems the deposited OFTs into asD for the caller.
4. Repeat if the legitimate lzCompose fails, racing the user/executor.
**How found:** Reading LayerZero V2 docs/README noting composed messages execute as a separate transaction, then observing lzCompose enforces no msg.sender constraint; confirmed via existing test 'lzCompose: successful deposit and send on canto'.
**Exploitation:** Attacker watches the destination chain for OFT deposits to ASDRouter, then calls the permissionless lzCompose before the executor, redeeming the victim's OFTs as asD to themselves.
**Insight:** When a protocol splits delivery and execution into separate permissionless transactions, check whether the execution entrypoint binds the caller or the pending message to the intended recipient; front-running the executor is the exploit.