# Cross-chain source identity trusted without binding

Caller or source identity taken from message, truncated hash, or deploy address without binding to authenticated origin

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-06-29. Updated 2026-10-24._

## How it works
A handler decides who is calling (or which chain/contract a message came from) using a value the caller controls, instead of a value the runtime authenticates. The broken assumption is that "the sender field" or "the address we compute" is trustworthy. In practice the sender can be supplied inside a message [E1](https://bugbountylibrary.com/r/h1%3A2976481.md), a recomputed address can be made to collide [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md), or a deterministic deploy address can be reproduced by a lower-privileged party on another chain [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md). In each case the check passes for an attacker because the identity was never bound to the authenticated context or origin chain.

## Where it shows up
- A module reads `msg.Sender` (or equivalent) from a user-supplied message rather than from the execution context [E1](https://bugbountylibrary.com/r/h1%3A2976481.md).
- Caller verification recomputes a CREATE2/CREATE3 address from calldata inputs and compares it to `msg.sender` [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md).
- Hash comparisons truncated to 160 bits (address width) [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md).
- A source address is treated as trusted without checking the source chain [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md).
- Trust anchored on an address that is deterministic from deployer + salt + deployer contract [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md).
- Sibling modules reading the same identity from context while one reads it from the message [E1](https://bugbountylibrary.com/r/h1%3A2976481.md).

## How to review
The invariant: every identity used in an authorization decision must come from a source the attacker cannot set — the authenticated execution context, a factory/registry lookup, or a binding that includes the source chain. Check each handler: where does the sender/origin value originate, and can calldata influence it? For recomputed addresses, require full-width hashing and a registry lookup rather than recomputation from caller inputs [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md). For cross-chain handlers, require the source chain to be part of the trust decision, not just the address [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md). Compare sibling modules for divergence [E1](https://bugbountylibrary.com/r/h1%3A2976481.md).

## Variants seen
- Sender taken from message instead of context, draining a victim's lockup account [E1](https://bugbountylibrary.com/r/h1%3A2976481.md).
- Truncated CREATE2 recomputation with attacker-controlled inputs, enabling allowance drain [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md).
- Deploy address trusted across chains, reproducible via CREATE3 by the original deployer [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md).

## Impact and severity
Unauthorized fund transfer from victim accounts [E1](https://bugbountylibrary.com/r/h1%3A2976481.md), draining all router token allowances [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md), and arbitrary token transfers via a spoofed service [E3](https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md). Severity is high where the trusted identity gates fund movement. It worsens when the trusted value is attacker-influenceable (message fields, calldata) or reproducible by a lower-privileged party across chains.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2976481.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-06.md