# Keeper will always overwrite the user txData in case of single cross-chain withdrawal

Keeper overwrites user-supplied txData in single cross-chain withdrawals, allowing swap parameters to be altered and funds left in contract.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: elhaj
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.7
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.7
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium technique:source-review vuln:business-logic

**Target:** CoreStateRegistry contract
**Root cause:** In _updateWithdrawPayload, for single withdrawals (multi==0), the code unconditionally sets singleVaultData.liqData.txData = txData_[0] instead of using the conditionally updated multiVaultData.liqData.txData[0] from _updateTxData.
**Steps:**
1. User initiates a single cross-chain withdrawal with a non-empty txData specifying swap parameters.
2. Keeper calls updateWithdrawPayload with its own txData_ array.
3. _updateTxData correctly preserves user's txData because it is non-empty.
4. However, _updateWithdrawPayload for multi==0 overwrites singleVaultData.liqData.txData with txData_[0] (keeper's data).
5. The withdrawal executes using the keeper's txData, not the user's.
**How found:** Code review of the _updateWithdrawPayload function revealed that the single-withdrawal branch ignores the result of _updateTxData and directly assigns the keeper's txData.
**Exploitation:** A malicious or compromised keeper can supply txData that sets a very low amountIn, causing only a small portion of withdrawn funds to be swapped and the remainder stuck in the superForm. It can also change the output token or alter the operation (e.g., swap only instead of swap and bridge).
**Insight:** When a function conditionally updates a data structure, ensure all code paths use the updated structure; look for branches that bypass the update logic.