Summary

A failed cross-chain transaction should return funds to their rightful owner. The reported refund logic did not consistently enforce that ownership for recipients on non-EVM chains.

Root cause

Refund processing combined recipient handling with the decision about who could claim funds. That design did not preserve the same authorization guarantees across the different address formats supported by the cross-chain system.

Attack scenario

The reported threat was an unauthorized party receiving funds during recovery from a cross-chain transaction. A refund intended to restore a user's balance could instead become another source of loss for that user.

Impact

Affected cross-chain users could lose the funds that should have been returned to them. Sherlock treated this as a direct financial loss issue, rather than a delay or an inconvenience in transaction recovery.

Fix recommendation

Separate recipient resolution from authorization and enforce explicit permissions for every supported chain. Sherlock reports a fix, but its linked pull request is closed without a merge; that link alone does not establish deployment status.