# Lifivalidator.validatetxdata calldata can decode to bridgedata type but also be compatible with generic swap

Crafted calldata decodes as BridgeData for LiFiValidator but also matches swapTokensGeneric, bypassing cross-chain validation to run an arbitrary local swap.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: cergyk
- Disclosed: 2024-02-13
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.12
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.12
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LiFiValidator.validateTxData / LiFi diamond swapTokensGeneric
**Root cause:** validateTxData assumes calldata valid for generic swap will fail extractMainParameters decoding, but a crafted blob decodes as BridgeData while also being valid for swapTokensGeneric, whose _transactionId offset overlaps the dynamic BridgeData pointer.
**Steps:**
1. Craft calldata whose bytes32 _transactionId acts as offset to a dynamic BridgeData that extractMainParameters decodes successfully.
2. Ensure same calldata is also valid for swapTokensGeneric(bytes32,string,string,address,uint256,SwapData[]).
3. Submit as cross-chain deposit to Superform; validation passes via BridgeData decode.
4. Execution routes to swapTokensGeneric performing an arbitrary local swap.
**How found:** Observed that cross-chain case is handled in try block and local in catch, relying on extractMainParameters failing for generic swap calldata; hypothesized an encoding valid for both and noted _transactionId can offset the dynamic BridgeData pointer.
**Exploitation:** Malicious user submits a cross-chain deposit whose calldata satisfies both decoders, bypassing validateTx chain and executing an arbitrary local swap instead of the intended cross-chain bridge.
**Insight:** When validation branches on try/catch decode success, hunt for calldata that decodes under both schemas; dynamic-type offset fields (like a bytes32 id) can be repurposed as ABI offsets to make two signatures collide.