# Attacker can deposit to non existing superform and change the token that should be re- turned

Cross-chain deposit accepts nonexistent superformId; failed-deposit rescue records attacker-controlled vault asset as settlement token, enabling inflated refunds.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: rvierdiiev
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** SuperformRouter cross-chain deposit / CoreStateRegistry failed-deposit rescue
**Root cause:** Cross-chain deposit path skips superform existence validation, and _updateSingleDeposit's try/catch records getVaultAsset() from an attacker-crafted invalid superform as the settlementToken for failed deposits.
**Steps:**
1. Call `SuperformRouter.singleXChainSingleVaultDeposit` with a `superformId` pointing to a nonexistent/attacker-crafted superform on the destination chain.
2. Omit dstSwap so bridged funds land in CoreStateRegistry and the invalid-superform branch is hit in `_updateSingleDeposit`.
3. Craft the fake superform's `getVaultAsset()` to return a more valuable token than deposited; it is pushed into `failedDeposits[payloadId_].settlementToken`.
4. Payload marked PROCESSED with amount 0; later `proposeRescueFailedDeposits` refunds based on the spoofed settlementToken.
**How found:** Code reading of _validateSuperformData noting existence check is skipped for cross-chain deposits, then tracing _updateSingleDeposit's try/catch that trusts getVaultAsset() from an unvalidated superform.
**Exploitation:** Attacker deposits a cheap token cross-chain to an invalid superformId whose getVaultAsset() returns a valuable token; the failed-deposit rescue then refunds the attacker in the more valuable token, yielding profit.
**Escalation:** Also exploitable if CORE_STATE_REGISTRY_RESCUER_ROLE is compromised, allowing arbitrary settlement token manipulation.
**Insight:** When a validation is skipped on one code path (cross-chain) but downstream logic still trusts the unvalidated identifier, look for try/catch fallbacks that read attacker-influenced state (like getVaultAsset) and feed it into settlement/refund accounting.