# Funds Paid to Wrong Recipient

Transfers, refunds or rewards sent to caller, contract or wrong address instead of the intended owner

_Area: DeFi accounting and math bugs. Seen in 57 disclosed reports; latest 2026-03-13. Updated 2026-10-23._

## How it works
A function computes an amount, then names a recipient that is not the party who should receive it. The broken assumption is that the caller, the tx initiator, the source-chain address, the contract itself, or a caller-supplied address is the rightful owner of the value. When that is false, funds land where the user cannot reach them, or where someone else can claim them. The invariant: the address credited or paid equals the address that deposited or owns the position, and the asset paid out equals the asset paid in.

## Where it shows up
- Refund/withdraw paths using a different funding source than the deposit path (supply vs collateral) [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-05.md)
- Caller-supplied `userAddress`/`beneficiary` trusted without binding it to the swap initiator [E2](https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md)
- Batch entry points resolving recipients differently from the single-item version [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md)
- Refund token differing from the token actually paid into the swap [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md)
- Repayment sent to the token contract instead of the contract that burns it [E4](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-06.md)
- Flash-swap callback encoding `msg.sender` as recipient instead of the vault/owner [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md)
- Cross-chain fallback reusing the execution target `_to` as beneficiary [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md)
- Refund sent to `FeePayer()` when a `FeeGranter()` actually paid [E8](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-02.md)

## How to review
For every transfer, name the intended recipient and prove the code names it. Then prove the asset paid out matches the asset paid in. Checklist:
- Refund source matches deposit source; compare sibling functions like `preRelease()` [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-05.md)
- Recipient resolution identical across single and batch paths; diff `claim()` vs `claim_many()` line by line [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md)
- Caller-supplied beneficiary bound to the initiator, not merely present in calldata [E2](https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md)
- Refunded token equals the token paid [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md)
- Tokens land in the contract that performs the burn/accounting, not the token contract [E4](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-06.md)
- Callback recipient is the intended beneficiary, not `msg.sender` [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md)
- Fallback/refund paths do not reuse an execution target as the beneficiary [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md)
- Refund recipient is the actual payer, including grant flows [E8](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-02.md)
Grep for `transfer`, `transferFunds`, `beneficiary`, `userAddress`, `_to`, `skim`, `FeePayer`.

## Variants seen
- Source mismatch on refund [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-05.md)
- Missing initiator binding on caller-supplied beneficiary [E2](https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md)
- Batch path omitting owner remapping [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md)
- Wrong refund token [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md)
- Repayment sent to token contract, breaking burn accounting [E4](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-06.md)
- Flash-swap recipient set to caller, draining vault reserve [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md)
- Cross-chain fallback pays execution target, not user [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md)
- Refund to payer instead of granter [E8](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-02.md)

## Impact and severity
Loss or lock of user funds, drained collateral or vault reserves [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-05.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md), rewards captured by an attacker [E2](https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md), or permanent loss across chains [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md). Severity rises when the wrong recipient is attacker-controlled [E2](https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md) or funds become unrecoverable [E5](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md). Batch and parallel-path variants [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-02.md) are easy to miss because the single-item version looks correct.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-04.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-9.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-06.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-04.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-05.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-04.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AH-02.md