# Funds Are Lost If The finalizeTransfer Call Fails

Primev Gateway deducts sender balance on source chain at initiateTransfer but has no refund if finalizeTransfer fails on destination, permanently losing user funds.

- Payout: Contest reward
- Severity: high
- Program: Primev
- Credited: jesjupyter
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** Cross-chain bridge Gateway.sol (initiateTransfer/finalizeTransfer)
**Root cause:** Source-chain balance is decremented in _decrementMsgSender at initiateTransfer, but finalizeTransfer on the destination can revert (paused, fee, index mismatch, contract bug) with no refund path crediting funds back on the source chain.
**Steps:**
1. Call `initiateTransfer` on source chain; `_decrementMsgSender` deducts msg.sender balance.
2. Relayer calls `finalizeTransfer(_recipient,_amount,_counterpartyIdx)` on destination chain.
3. Cause revert: `whenNotPaused` paused, `_amount < finalizationFee`, or `_counterpartyIdx != transferFinalizedIdx`.
4. Observe no refund mechanism restores the deducted source-chain balance; funds stuck/lost.
**How found:** Code review of the two-step cross-chain flow: noticed balance deduction happens at initiateTransfer while finalization is a separate, fallible step with no compensating refund logic.
**Exploitation:** Not an attacker-driven exploit; failure of finalizeTransfer (pause, fee, index mismatch, or contract bug) strands already-deducted user funds with no refund path.
**Insight:** In two-phase bridge designs, audit the asymmetry between the debit step and the credit step: any revert path in the credit phase without a refund/rollback on the debit side is a fund-loss vector.