# Arbitrum Retryable-Ticket Refund/Value Not Verified Enables Timelock ETH Exfiltration

GuardCM ignores timelock value and Arbitrum retryable-ticket refund recipients, letting a compromised CM divert timelock ETH via attacker-controlled refund addresses.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: 0xb0k0
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** GuardCM Safe guard and ProcessBridgedDataArbitrum bridge verifier
**Root cause:** GuardCM._verifySchedule decodes but never constrains the timelock value, and ProcessBridgedDataArbitrum validates only L2 targetAddress and selector while ignoring excessFeeRefundAddress/callValueRefundAddress and fee knobs.
**Steps:**
1. CM schedules timelock call to Arbitrum Inbox `createRetryableTicket`/`unsafeCreateRetryableTicket` with large `value`.
2. Craft ticket: `targetAddress` = whitelisted L2 contract, `targetPayload` starts with whitelisted selector, but `excessFeeRefundAddress`/`callValueRefundAddress` = attacker addresses.
3. GuardCM.checkTransaction approves because value is unchecked and verifier only checks L2 target+selector.
4. Timelock executes, forwards ETH to Inbox; excess fees/value refunded to attacker-controlled recipients.
**How found:** Code review of GuardCM._verifySchedule and ProcessBridgedDataArbitrum: noticed value decoded but discarded, and bridge verifier extracts only targetAddress/targetPayload, hypothesizing refund-recipient abuse.
**Exploitation:** A compromised/threshold-meeting CM signer schedules an allowlisted L2 action through the Arbitrum Inbox with attacker-controlled refund recipients and a large timelock value; on execution the retryable-ticket refund mechanics divert timelock ETH to the attacker.
**Insight:** When a guard allowlists bridged calls by target+selector, also audit the bridge's economic/refund parameters (excessFeeRefundAddress, callValueRefundAddress, l2CallValue) and the forwarded msg.value—allowlisting calldata alone leaves value-redirection open.