# A recalled ERC20 bridge transfer can lock tokens in the bridge

Recalled USDC bridge transfer reverts when USDCAdapter minting allowance is exhausted, locking bridged USDC and ETH in the vault.

- Payout: Contest reward
- Severity: medium
- Program: Taiko
- Credited: monrel
- Disclosed: 2024-04-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-taiko-findings/issues/279
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AM-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic vuln:dos

**Target:** ERC20Vault / USDCAdapter bridge token minting
**Root cause:** onMessageRecalled calls _transferTokens which mints via USDCAdapter; if the minter's mintingAllowedAmount is exhausted, usdc.mint reverts and the recalled message cannot complete, trapping the bridged tokens and ETH.
**Steps:**
1. User bridges USDC L2->L1 via ERC20Vault.
2. Message is recalled on L1, invoking onMessageRecalled -> _transferTokens -> USDCAdapter._mintToken -> usdc.mint.
3. USDCAdapter has reached mintingAllowedAmount so `require(_amount <= mintingAllowedAmount)` reverts.
4. Recalled message stays stuck; USDC and ETH remain locked until allowance frees up.
**How found:** Code-reading of _transferTokens shared by onMessageInvocation and onMessageRecalled, noticing the mint path can revert on Circle's minter allowance cap, making the recall non-completable.
**Insight:** When a recall/refund path reuses the same mint logic as the forward path, check external token caps (e.g. Circle minter allowances) that can make the refund revert and trap funds.