I Found a Bug That Permanently Burns Money

I found a bug that turns money into smoke. lrjov. One line of code. No validation. Just subtraction.

On certain chains, every single cross-chain transfer would have just... vanished. User funds gone. Forever. The auditors missed it. I didn't. Here's how it happened. I started on a betting site. Hit authentication walls. Got bored fast. Then I found Overlayer's DualDefense Audit on HackenProof.

Smart contracts. No logins. No KYC walls. Just pure code staring back at me.

I decided to give it a shot. The Moment I was scrolling through OverlayerWrapCore.sol.

Most of it looked fine. Standard stuff.

Then I saw this:

function credit(
    address to,
    uint256 amountLD_,
    uint32 srcEid_
) internal virtual override returns (uint256 amountReceivedLD) {
    amountReceivedLD = super.credit(to, amountLD_, srcEid_);
    totalBridgedOut -= amountReceivedLD;  
}

No check. No require. No validation. Just blind subtraction. I stared at it for 30 seconds ( շշմած )

Then it hit me. This function is called when tokens arrive on the destination chain after a cross-chain transfer. Normally, it works like this.

Step 1 - User sends tokens cross-chain - _debit() called → INCREASES

Step 2 - User receives on destination - _credit() called → DECREASES

Balance returns to normal. Everything works. But I asked myself a question:

chto budet esli _credit() gets called without a matching _debit() first?

I looked closer. The protocol has something called non-hub chains. On non-hub chains, totalBridgedOut starts at 0. And it never increases. So when the bridge tries to deliver tokens.

totalBridgedOut (0) -= amount (100) = UNDERFLOW

The transaction would revert. The bridge message would fail. But the user's tokens?

Already burned on the source chain. Gone. Forever. Never arriving on the destination.

Money turned into smoke.

The Test

I needed to prove it wasn't just a theory. I wrote a Foundry test. 15 lines of code. solidity

function testCreditWithoutDebit() public {
    assert(core.totalBridgedOut() == 0);
    vm.expectRevert();
    core.testCredit(user, 100, srcEid);
}

I ran it. It reverted. Exactly as predicted. The bug was real.

The Report

I submitted to HackenProof.

Included. The exact lines of code, The Foundry test (working PoC), The impact analysis (permanent fund loss), The suggested fix, Then I waited.

The Triage

Two days later, the triage team responded.

Here's what they said:

"This issue has been validated as Critical."

"On non-hub chains, totalBridgedOut is initialized to 0 and can never be incremented, causing an arithmetic underflow on any inbound bridge credit."