# Improper Transfer Restrictions on Non-Bridged Tokens Due to Boolean Bridged Token Tracking, Allowing a DoS Attack Vector

Titn.sol marks any address receiving bridged TITN as a permanent bridged holder, so an attacker sending 1 wei locks the victim's entire non-bridged balance from transfer.

- Payout: Contest reward
- Severity: medium
- Program: THORWallet
- Credited: Limbooo
- Disclosed: 2025-04-15
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-thorwallet#m-1
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Titn.sol ERC20 bridge token (LayerZero OFT) on Base/Arbitrum
**Root cause:** isBridgedTokenHolder is a boolean set true on any bridged credit and never cleared, and _validateTransfer blocks all transfers from such addresses regardless of how many tokens were actually bridged.
**Steps:**
1. Attacker obtains TITN on Arbitrum and calls `send(sendParam, [fee,0], ...)` with `to` = victim address and amount 1 wei via LayerZero.
2. Victim's address gets `isBridgedTokenHolder[victim] = true` in `_credit` (Titn.sol#L106-L108).
3. Victim attempts `transfer(other, balance)` of purely non-bridged TITN.
4. `_validateTransfer` (Titn.sol#L82-L83) sees `isBridgedTokenHolder[from]` true and `to != lzEndpoint`, reverts `BridgedTokensTransferLocked()`.
5. Repeat for any address to grief; only transfers to lzEndpoint/transferAllowedContract succeed.
**How found:** Code review of the bridging credit path and transfer validation: noticed the boolean flag is set on any bridged receipt and never reset, then reasoned that a 1 wei inbound bridge transfer permanently taints the recipient's whole balance.
**Exploitation:** Attacker bridges a trivial 1 wei of TITN to the victim's address on Base, flipping the boolean flag; the victim's entire TITN balance (bridged or not) becomes non-transferable except to the LayerZero endpoint, denying normal token utility.
**Insight:** When a protocol gates transfers on a per-address boolean 'has bridged' flag, check whether an attacker can flip that flag for arbitrary addresses via a cheap inbound bridge/credit; balance-based accounting avoids this griefing.