# Lack of refund handling from lifi bridge

Superform's BaseRouterImplementation dispatches tokens via LiFi bridge but never handles LiFi refunds, so failed cross-chain transfers refund tokens to the router and they are lost.

- Payout: Contest reward
- Severity: high
- Program: Superform Erc1155a
- Credited: ladboy233 - Sparkware
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm technique:source-review vuln:business-logic

**Target:** BaseRouterImplementation.sol cross-chain bridge dispatch
**Root cause:** _dispatchTokens sends tokens to the LiFi bridge but the router has no logic to detect or recover tokens refunded by LiFi when a cross-chain transfer fails, so refunds land at the router and are stranded.
**Steps:**
1. User initiates cross-chain deposit/withdrawal routed through LiFi via BaseRouterImplementation.
2. _dispatchTokens calls superRegistry.getBridgeAddress(bridgeId) and transfers args_.liqRequest.token to the bridge.
3. LiFi transfer fails (e.g. swap liquidity exhausted, returns nextToken/hToken or REFUNDED status).
4. LiFi refunds the sent token back to msg.sender (the router).
5. Router has no refund-handling path, so refunded tokens remain stuck/lost.
**How found:** Read LiFi documentation noting REFUNDED status and amarok/hop nextToken/hToken edge cases where swap liquidity is exhausted, then reviewed _dispatchTokens and observed the router is msg.sender with no refund handling.
**Exploitation:** No direct attacker extraction described; impact is loss of user funds when a LiFi bridge transfer fails and the refund is stranded at the router with no recovery mechanism.
**Insight:** When integrating third-party bridges, check the bridge's failure/refund semantics (REFUNDED status, nextToken/hToken minting) and verify the integrating contract can receive and forward refunds rather than stranding them at the router.