# Withdrawal on xchain will revert when srcsender != receiveraddress

Cross-chain withdrawal reverts when source sender differs from receiver address because keeper-supplied txData is validated against inconsistent addresses in two places.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: rvierdiiev
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** CoreStateRegistry / ERC4626FormImplementation cross-chain withdrawal flow
**Root cause:** CoreStateRegistry._updateTxData validates txData receiver against srcSender, but ERC4626FormImplementation._processXChainWithdraw re-validates using singleVaultData_.receiverAddress as srcSender; when the two differ, the second check reverts.
**Steps:**
1. User submits withdrawal with receiverAddress != source-chain sender and no txData in liqRequest.
2. Keeper calls CoreStateRegistry.updateWithdrawPayload -> _updateTxData, supplying txData with source-chain initiator as receiver to pass validation.
3. Cross-chain withdrawal processed; ERC4626FormImplementation._processXChainWithdraw checks txData again using singleVaultData_.receiverAddress as srcSender.
4. Since receiverAddress != srcSender, validation reverts and withdrawal fails.
**How found:** Code reading of the two validation sites: noticed _updateTxData uses srcSender while _processXChainWithdraw uses singleVaultData_.receiverAddress as srcSender, making the keeper's valid txData fail the second check.
**Insight:** When the same payload is validated in two places, check whether each site derives the expected sender from a different field; a keeper-built payload that satisfies the first check can be rejected by the second, bricking the flow.