# Unverified `_srcChainSender` parameter allows to impersonate the sender

UsdoReceiver forwards attacker-controlled compose messages without verifying _srcChainSender, letting anyone invoke UsdoMarketReceiverModule actions on behalf of arbitrary users.

- Payout: Contest reward
- Severity: high
- Program: Tapioca
- Credited: ComposableSecurity
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/14
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:auth-bypass

**Target:** LayerZero OFT compose receiver (UsdoReceiver / UsdoMarketReceiverModule)
**Root cause:** _toeComposeReceiver forwards _toeComposeMsg to modules like UsdoMarketReceiverModule without checking that msg_.user equals _srcChainSender, so the whitelisted USDO contract executes actions for any user.
**Steps:**
1. Craft a LayerZero compose message with `_msgType = MSG_MARKET_REMOVE_ASSET` and `_toeComposeMsg` encoding `msg_.user = victim`, `msg_.externalData.magnetar = whitelisted magnetar`, `msg_.removeAndRepayData`, and `_action.id = exitPositionAndRemoveCollateral`.
2. Send the compose message so `_toeComposeReceiver` calls `removeAssetReceiver(_toeComposeMsg)` without validating `_srcChainSender`.
3. `removeAssetReceiver` decodes `_data` and calls `magnetar.burst(...)` with the attacker-supplied calls.
4. MagnetarOptionModule `_checkSender` passes because sender is the whitelisted USDO contract.
5. `exitPositionAndRemoveCollateral` executes on behalf of the victim user.
**How found:** Code review of _toeComposeReceiver: noticed _srcChainSender is only forwarded for MSG_TAP_EXERCISE, while other msg types pass attacker-controlled _toeComposeMsg straight to modules that trust the whitelisted USDO caller.
**Exploitation:** Attacker submits a crafted cross-chain compose message; the whitelisted USDO contract acts as sender, so Magnetar's _checkSender passes and exitPositionAndRemoveCollateral runs against the victim's position, removing collateral / exercising options without their consent.
**Insight:** When a trusted router/endpoint forwards a compose payload, check whether the module re-derives the acting user from the payload instead of binding it to the authenticated cross-chain sender; whitelisted-caller checks then become an impersonation primitive.