# Dstswapper.processtx an attacker can use multiple destination swaps back and forth to inflate xchain deposit

DstSwapper._processTx only tracks target-token increases per swap, so batched back-and-forth swaps let an attacker inflate swappedAmount and drain DstSwapper liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: cergyk
- Disclosed: 2024-02-13
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.10
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.10
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** DstSwapper._processTx cross-chain swap processor
**Root cause:** Each swap only measures balanceAfter-balanceBefore of the target token and never registers the source-token decrease, so the same liquidity can be counted as output across multiple swaps in one payloadId.
**Steps:**
1. Craft a cross-chain deposit payload with N swaps alternating tokenA->tokenB and tokenB->tokenA for amount X under one payloadId.
2. Ensure initial bridged liquidity is only X tokenA (e.g. via unmatched interim tokens, attacker-controlled receiver, or gas manipulation to fail bridging).
3. Operator calls DstSwapper._processTx for each swap; each records balanceDiff = X as swappedAmount[payloadId][index].
4. Sum of recorded swappedAmounts = N*X while only X was supplied, letting attacker withdraw N*X from DstSwapper liquidity.
**How found:** Code review of _processTx noticed it only checks target-token balance increase and never records the source-token decrease, implying the same liquidity can be reused across swaps in one payloadId.
**Exploitation:** Attacker submits a payload with repeated back-and-forth swaps between two tokens; operator processes them in batch, each swap passes the balanceAfter>balanceBefore and slippage checks, and swappedAmount is credited N times, allowing the attacker to drain DstSwapper's pooled liquidity.
**Escalation:** Repeat across payloadIds or scale N to drain the full DstSwapper balance; relies on off-chain infra processing swaps despite failed bridging.
**Insight:** In batch swap processors, verify that per-swap accounting tracks both sides of the balance delta; if only the output token is measured, alternating swaps can recycle the same liquidity and inflate credited amounts.