# ClaimCancelRedeemRequest7540Hook.sol doesn't fill cross chain data

ClaimCancelRedeemRequest7540Hook omits vaultBank/dstChainId fields, so SuperExecutorBase skips the vaultBank approval needed for cross-chain claims of redeemed 7540 shares.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: T1MOH
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.18
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.18
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Superform hook contracts / SuperExecutorBase cross-chain approval logic
**Root cause:** SuperExecutorBase._checkAndLockForSuperPosition reads vaultBank() and dstChainId() from the hook to build the spToken approval, but ClaimCancelRedeemRequest7540Hook never populates these fields, so vaultBank is address(0) and the approval branch is skipped.
**Steps:**
1. Inspect SuperExecutorBase._processHook: after execution it calls _checkAndLockForSuperPosition(account, hook).
2. Note _checkAndLockForSuperPosition reads `vaultBank = ISuperHookResult(hook).vaultBank()` and `dstChainId = ...dstChainId()`, and only builds `IERC20.approve(vaultBank, outAmount)` on spToken when vaultBank != address(0).
3. Compare hooks that set these fields: ApproveAndDeposit4626VaultHook, Deposit4626VaultHook, ApproveAndDeposit5115VaultHook, Deposit5115VaultHook, Deposit7540VaultHook, EthenaUnstakeHook.
4. Observe ClaimCancelRedeemRequest7540Hook (ERC-7887 cancel-redeem claim) does not set vaultBank/dstChainId.
5. Execute a flow using ClaimCancelRedeemRequest7540Hook and confirm no approval to vaultBank is created, breaking the cross-chain claim path.
**How found:** Code review of SuperExecutorBase's cross-chain approval logic, then enumerating every hook that returns vault shares/USDe and diffing which ones populate vaultBank/dstChainId; ClaimCancelRedeemRequest7540Hook was the outlier.
**Insight:** When a base executor branches on hook-returned metadata (vaultBank/dstChainId), enumerate all hook implementations and diff which ones set those fields — a single hook missing the setter silently disables the downstream approval/execution path.