# Lifivalidator.validatetx performs an incorrect receiver check for lifi over stargate/celer/amarok bridging

LiFiValidator only checks BridgeData.receiver, but StargateFacet routes funds to _stargateData.callTo, letting a user redirect bridged tokens to themselves.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: cergyk
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.9
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** LiFiValidator.validateTxData / StargateFacet bridge path
**Root cause:** validateTxData validates only ILiFi.BridgeData.receiver, while StargateFacet._startBridge uses _stargateData.callTo as the destination receiver, so the validated field is not the one actually used.
**Steps:**
1. Craft a LiFi bridge tx via StargateFacet with hasDestinationCall=false and empty callData.
2. Set BridgeData.receiver to a legitimate/expected address so validateTxData passes.
3. Set _stargateData.callTo to the attacker's address on the destination chain.
4. Submit; tokens are bridged and delivered to callTo, not the validated receiver.
**How found:** Code reading: noticed validateTxData extracts receiver from BridgeData, then traced StargateFacet._startBridge and saw it passes _stargateData.callTo as the LayerZero/Stargate destination receiver, a field not covered by the validator's checks.
**Exploitation:** Attacker bridges tokens with callTo set to themselves; on the destination chain the keeper may treat the bridge as completed and release DstSwapper liquidity, letting the attacker consume liquidity intended for another user's bridge or pre-existing DstSwapper funds.
**Escalation:** Impact scales with off-chain keeper logic: if keepers credit bridged amounts against shared DstSwapper liquidity, attacker can drain liquidity belonging to other users.
**Insight:** When a validator whitelists a wrapper protocol (LiFi) that fans out to underlying bridges (Stargate/LayerZero), enumerate every underlying struct field that becomes a destination/receiver and confirm the validator checks that exact field, not the wrapper's nominal receiver.