# Insufficient merkle leaf creation on source chain may lead to dos on destination chains

SuperMerkleValidator omits proofDst from the signed merkle leaf, letting anyone tamper a UserOp signature so it passes on source chain but reverts on destination, griefing bridged funds.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: seeques
- Disclosed: 2025-07-17
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos vuln:signature-replay

**Target:** ERC-4337 UserOp signature validation / SuperMerkleValidator
**Root cause:** _processSignatureAndVerifyLeaf builds the leaf only from userOpHash and validUntil, so proofDst is never bound to the signature and can be altered freely.
**Steps:**
1. Observe SignatureData struct: validUntil, merkleRoot, proofSrc, proofDst, signature.
2. Note leaf = _createLeaf(abi.encode(userOpHash), validUntil); proofDst not included.
3. Decode a valid signatureData and replace proofDst with `new bytes32[](0)`.
4. Re-encode and set as userOp.signature; submit UserOp on source chain.
5. Source chain validation passes (proofSrc still valid), bridge request sent via DeBridge/Across.
6. Destination SuperDestinationExecutor.processBridgedExecution reverts on invalid proofDst, funds stuck in adapter.
**How found:** Code reading of _processSignatureAndVerifyLeaf: noticed leaf construction omits proofDst, hypothesizing signature fields not covered by the leaf can be tampered without invalidating source-chain verification.
**Exploitation:** Attacker sees a UserOp in mempool, frontruns with tampered proofDst (e.g. empty array). Source-chain validation succeeds and a bridge order is dispatched; destination execution reverts, leaving bridged assets temporarily stuck in adapter contracts until authorized retrieval.
**Insight:** When a signature covers a struct, enumerate every field and check which are actually committed in the signed hash/leaf; any field outside the commitment (like a destination proof) is attacker-mutable and can desync cross-chain validation.