# Unverified solution parameters in recharge_settle could lead to loss of tokens

recharge_settle trusted caller-supplied crt_tail_hash to derive funding_coin_id, letting an attacker redirect minted CRT tokens to a fake CAT and steal auction rewards.

- Payout: Contest reward
- Severity: critical
- Program: Circuit Puzzles
- Credited: maxzuvex
- Disclosed: 2025-08-21
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:critical tech:solidity technique:incomplete-fix technique:source-review vuln:access-control vuln:business-logic

**Target:** Chia Clvm puzzle recharge_settle.clsp (recharge auction settlement)
**Root cause:** recharge_settle computes funding_coin_id from solution-supplied crt_tail_hash and funding_coin_info instead of deriving the canonical CRT tail hash from its curried STATUTES_STRUCT, so all three coin-id inputs are attacker-controlled.
**Steps:**
1. Wait for a recharge auction to conclude; note winning bid amount.
2. Create a fake CAT with custom tail hash and matching issuance coin via run_tail.clsp.
3. Front-run the winner by calling recharge_settle on the finalized auction coin.
4. Supply solution with `crt_tail_hash` = fake CAT tail hash and `funding_coin_info` = parent_id/amount of attacker's fake issuance coin.
5. Puzzle computes funding_coin_id pointing to attacker coin and emits SEND_MESSAGE 0x3f to it.
6. Attacker's issuance coin mints lookalike CRT; real winner receives nothing.
**How found:** Reviewer revisited Zellic finding 3.9 (same flaw in recharge_win) and checked whether remediation commits badd1d21/b80b2663 actually fixed it; found they only refactored, shifting trust from funding_coin_id to crt_tail_hash without on-chain validation against STATUTES_STRUCT.
**Exploitation:** Attacker front-runs settlement of any concluded recharge auction, substituting a fake CAT tail hash and fake issuance coin info so the SEND_MESSAGE mint instruction targets their own coin, minting tokens to themselves while the legitimate winner gets no CRT.
**Insight:** When a fix internalizes one attacker-controlled parameter, check whether it merely moved trust to another solution field; verify the canonical value is derived from curried trusted state, not passed in.