# Anyone can execute certain functions that use cross chain messages and potentially cancel them with potential loss of funds.

Unprotected cross-chain message functions in Derby let anyone trigger state changes and cancel Connext xcalls as delegate, desyncing chains and risking fund loss.

- Payout: Contest reward
- Severity: high
- Program: Derby
- Credited: Jeiwan
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/390
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** MainVault/Game/XChainController cross-chain messaging via Connext XProvider
**Root cause:** Cross-chain send functions (pushTotalUnderlyingToController, sendRewardsToGame, sendFundsToVault, pushAllocationsToController) lack access control, and XProvider sets msg.sender as the Connext delegate, letting any caller cancel the xcall on destination.
**Steps:**
1. Identify unprotected functions like `MainVault.pushTotalUnderlyingToController()` and `XChainController.sendFundsToVault()`
2. Call the function with low `msg.value` so relayer fee is insufficient and message stalls
3. Or call it and, as the delegate set to msg.sender, cancel the xcall on destination via Connext
4. Origin chain state changes irreversibly while destination never executes, desyncing contracts
**How found:** Manual review of access control on cross-chain functions and reading Connext xcall semantics where delegate = msg.sender enables cancellation.
**Exploitation:** Attacker calls an unprotected cross-chain function, irreversibly mutating origin-chain state, then uses delegate privilege (msg.sender) to cancel the Connext xcall so the destination chain never processes it, leaving vaults out of sync and potentially locking/misrouting funds.
**Escalation:** Applies to multiple functions including sendFundsToVault where actual funds transfer, amplifying loss potential.
**Insight:** When a contract forwards msg.sender as the Connext delegate, any caller of an unprotected wrapper gains cancellation rights over the cross-chain message; audit delegate assignment alongside access control on send wrappers.