# The user can send tokens to any address by using two bridge transfers, even when transfers are restricted.

THORWallet TITN transfer lock bypassed via two LayerZero bridge sends (mint/burn path skips _validateTransfer), letting users move tokens to any address pre-TGE.

- Payout: Contest reward
- Severity: high
- Program: THORWallet
- Credited: shaflow2
- Disclosed: 2025-04-15
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-thorwallet#h-2
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Titn.sol ERC20 bridge token (LayerZero OFT) on Arbitrum/Base
**Root cause:** _validateTransfer only guards transfer/transferFrom; bridge send() uses mint/burn and never invokes the restriction, so locked tokens can still be bridged out and re-bridged to an arbitrary recipient.
**Steps:**
1. Admin sets isBridgedTokensTransferLocked=true; user1 holds TITN on Arbitrum.
2. Confirm direct `arbTITN.transfer(user2, 1e18)` reverts with `BridgedTokensTransferLocked`.
3. Build sendParam with `eidA` (Base), zeroPadded user1 address, tokensToSend=1e18; call `arbTITN.quoteSend(sendParam,false)` for nativeFee.
4. Call `arbTITN.connect(user1).send(sendParam,[nativeFee,0],user1.address,{value:nativeFee})` — tokens minted to user1 on Base.
5. Build sendParam2 with `eidB` (Arbitrum), zeroPadded user2 address; call `baseTITN.connect(user1).send(sendParam2,[nativeFee2,0],user2.address,{value:nativeFee2})`.
6. user2 balance on Arbitrum becomes 1e18 despite lock.
**How found:** Code review of transfer/transferFrom overrides noticed bridge send() bypasses _validateTransfer because it uses mint/burn rather than transfer; hypothesized a round-trip bridge would deliver tokens to an arbitrary address.
**Exploitation:** Any locked-token holder bridges to a self-controlled address on another chain, then bridges back to the target recipient, sidestepping the transfer restriction entirely; only gas/LZ fees required.
**Escalation:** Enables pre-TGE trading pools / speculative pricing of bridged TITN, breaking the no-transfer-until-TGE invariant.
**Insight:** When a token restricts transfer/transferFrom, check every other value-moving path (bridge send, mint/burn, permit, hook callbacks) — cross-chain round-trips are a classic way to launder a transfer restriction.