DODO Cross-Chain DEX · FINDING NOTE
Cross-chain refunds lacked consistent authorization
Reported as HarryBarz. View the public report
Credited alongside other researchers in the final High finding group, H-5.
1 min read
Page link
Summary
A failed cross-chain transaction should return funds to their rightful owner. The reported refund logic did not consistently enforce that ownership for recipients on non-EVM chains.
Root cause
Refund processing combined recipient handling with the decision about who could claim funds. That design did not preserve the same authorization guarantees across the different address formats supported by the cross-chain system.
Attack scenario
The reported threat was an unauthorized party receiving funds during recovery from a cross-chain transaction. A refund intended to restore a user's balance could instead become another source of loss for that user.
Impact
Affected cross-chain users could lose the funds that should have been returned to them. Sherlock treated this as a direct financial loss issue, rather than a delay or an inconvenience in transaction recovery.
Fix recommendation
Separate recipient resolution from authorization and enforce explicit permissions for every supported chain. Sherlock reports a fix, but its linked pull request is closed without a merge; that link alone does not establish deployment status.