# Issue with native token swap execution in Swap1inchHook

Swap1inchHook leaves Execution.value stale when usePrevHookAmount is true, so native ETH swaps send msg.value=0 and revert.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: gh0xt
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.3
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Swap1inchHook.build() hook building 1inch aggregation router executions
**Root cause:** When usePrevHookAmount is true, the swap amount is rewritten from prevHook.outAmount() into the 1inch calldata, but the Execution.value field is still taken from the static encoded value instead of the dynamic amount.
**Steps:**
1. Craft hook payload `[dstToken][dstReceiver][value=0][usePrev=0x01][1inch swap calldata]` with srcToken = 0xEeee...EEeE (native).
2. Call `Swap1inchHook.build(prevHook, account, hookData)` where prevHook.outAmount() returns 1000.
3. Observe `executions[0].value == 0` while the 1inch calldata amount is 1000.
4. Execution sends msg.value=0 to the aggregation router, which expects 1000 wei of ETH, so the swap reverts.
**How found:** Code review of build(): noticed the dynamic amount is injected into updatedTxData but the Execution.value field is copied from the static encoded value, so the two diverge when usePrevHookAmount is set.
**Insight:** In hook/composable execution frameworks, whenever a calldata field is dynamically rewritten from a prior step's output, audit every sibling field (especially native value/msg.value) for the same rewrite — mismatches between calldata amount and attached ETH are a recurring bug class.