# Cross-chain callback failure strands funds

Failed or timed-out remote callback with no refund or unlock of burned or escrowed tokens

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-02-20. Updated 2026-10-24._

## How it works
A bridge moves value in two steps: the source side locks or burns tokens, and the destination side is supposed to release them or report back. The broken assumption is that every terminal outcome of the remote call is handled. When the destination callback fails, times out, or is never processed, the source-side escrow or burn is never reversed. The message reaches a terminal state (Failed) but the value does not move back to the initiator, so it is stranded [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md). A related shape: a replay or state guard that silently stops working, so a message can be processed more than once or a ledger entry is created on the wrong side [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md).

## Where it shows up
- Callback handlers whose failure branch only sets a status flag and performs no token transfer [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md).
- Settlement modes (MintBurn, LockUnlock, LockMint, BurnUnlock) where the source-side lock/burn has no matching release path on failure [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md).
- Remote-deploy or remote-registration functions that do not validate the destination against the origin chain [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md).
- Balance-tracking code that deliberately leaves one side untracked, plus any path that can create a tracked entry for that side [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md).
- Replay guards backed by mappings that may be empty after a migration or storage-layout change [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md).
- Upgrade/migration tooling that wipes or reorders storage the guard depends on [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md).

## How to review
Enumerate every terminal state of a cross-chain message: success, failure, timeout, and never-delivered. For each, verify the invariant that value returns to the initiator or remains claimable by them. Check that the Failed branch actually moves tokens, not just status [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md). For remote-deploy paths, confirm destinationChain != originalChain is enforced [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md). For replay guards, confirm the mapping is populated and survives migration; verify the deployed storage layout matches the spacers [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md).

## Variants seen
- Status-only failure branch with no refund [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md).
- Self-referential remote deploy creating an untracked-side ledger entry, DoSing bridging [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md).
- Migration wiping replay-guard storage, allowing double relay [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md).

## Impact and severity
Permanent loss of locked or burned user funds [E3](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md); bridge DoS or capped bridgeable amount [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md); double spending of bridged assets [E2](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md). Severity is high because funds are unrecoverable and the trigger is a normal failure path, not an exotic condition.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-11.md