# All reallocate cross-chain token and rewards will be lost for the users using the account abstraction wallet

NudgeCampaign sends reallocated cross-chain tokens and rewards to the source-chain address, which differs for account-abstraction wallets, permanently losing funds and locking rewards.

- Payout: Contest reward
- Severity: medium
- Program: Nudge.xyz
- Credited: 0xDemon
- Disclosed: 2025-04-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-03-nudgexyz#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:access-control vuln:accounting-error

**Target:** NudgeCampaign.sol / NudgePointsCampaigns.sol cross-chain reallocation and reward claim
**Root cause:** handleReallocation uses the source-chain userAddress as the destination recipient and stores it in Participation, but account-abstraction wallets have different addresses per chain, so tokens go to an address the user does not control and claimRewards' msg.sender check fails.
**Steps:**
1. Alice connects Ethereum mainnet AA wallet address on Nudge site.
2. Alice initiates cross-chain reallocation of 100 ETH on Ethereum to 200k USDC on Base via LiFi.
3. LiFi swaps and calls `handleReallocation(campaignId_, userAddress, toToken, toAmount, data)` with userAddress = Alice's Ethereum address.
4. Contract executes `_transfer(toToken, userAddress, amountReceived)` sending USDC to Alice's Ethereum address on Base, which she does not own.
5. Participation stores userAddress = Ethereum address; later `claimRewards(pID)` reverts `UnauthorizedCaller` because msg.sender (Base AA address) != participation.userAddress.
**How found:** Reading the cross-chain reallocation flow and noticing the recipient is taken from the source-chain userAddress with no destination-address parameter, then cross-referencing the claimRewards msg.sender equality check against AA wallet per-chain address behavior.
**Exploitation:** No attacker needed; a legitimate user following the documented flow loses reallocated tokens to an uncontrolled address and cannot claim rewards, which remain locked in NudgeCampaign since rescueTokens/withdrawRewards cannot recover them.
**Insight:** When a protocol accepts a user address on one chain and reuses it as a recipient or authorization key on another, check whether smart-contract/AA wallets have chain-specific addresses; any msg.sender==storedAddress check breaks for them and funds sent to the raw address are unrecoverable.