# Cross-chain address lookup mismatch

Cross-chain handlers using the wrong chain's token, market, or caller address to look up or settle state

_Area: Smart contract access control and control flow. Seen in 11 disclosed reports; latest 2025-07-22. Updated 2026-10-23._

## How it works
A cross-chain flow touches two address spaces: the source chain's and the destination chain's. The root cause is using an identifier from one space to look up or settle state that lives in the other. The assumption that breaks is that an address, tokenId, or caller identity means the same thing on every chain. It does not: the same address can be a different contract, a tokenId counter can diverge, and a market may exist on only one chain. When the handler resolves a position or recipient with the wrong chain's identifier, the lookup fails, resolves to the wrong object, or settles against an account the caller does not control.

## Where it shows up
- A destination-chain handler reusing a source-chain token/market address to find a position [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-4.md).
- Identity derived from caller address alone, with no source chain ID bound [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AH-02.md).
- Per-chain auto-incrementing tokenId counters with minting allowed on more than one chain [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-19.md).
- Destination handlers reading state (markets, accounting) that only exists on the host chain [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-18.md).
- Validators checking one receiver field while the underlying bridge uses another [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9.md).
- Array-of-destinations validated by membership of a single element [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-5.md).
- Accounting that silently skips uninitialized entries [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md).
- Parallel implementations (Solidity/Cairo) passing the wrong state variable [E7](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-01.md).

## How to review
For every cross-chain message, label each field with the chain whose address space it belongs to, then confirm the handler on the receiving side uses the field translated for that chain. The invariant: any lookup or settlement key must be expressed in the address space of the chain where the lookup executes, and any identity must be bound to (address, source chain). Check that minting of shared identifiers is restricted to one canonical chain, that validators check the exact field the downstream bridge uses as receiver, and that destination handlers only read state that exists on that chain.

## Variants seen
- Wrong-chain token address in liquidation lookup [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-4.md).
- Caller address without chain binding [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AH-02.md).
- TokenId collision across chains [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-19.md).
- Host-only market read on non-host chain [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-18.md).
- Validated receiver differs from used receiver [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9.md).
- Array-vs-scalar destination validation [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-5.md).
- Uninitialized accounting skipped [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md).
- Wrong state variable in parallel implementation [E7](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-01.md).

## Impact and severity
Outcomes ranged from locked bridged collateral and broken liquidation [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-18.md)[E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-4.md) to permanent DoS of minting [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-19.md), fund loss via misrouted destinations [E5](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-5.md)[E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9.md), and drain of a multisig's virtual account [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AH-02.md). Severity rises when the mismatch is permanent (no retry path) or lets an attacker who controls the same address on another chain act as the victim.

## Why fixes fail
Fixes that patch one field can miss sibling fields in the same struct or the parallel implementation; the receiver mismatch [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9.md) and copy-paste error [E7](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-01.md) show validation must be diffed field-by-field against what downstream actually consumes.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-19.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AH-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-18.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-5.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-4.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-01.md
- E8: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.9.md