Submitted by Limbooo, also found by 0xAadi, 0xAsen, 0xAsen, 0xastronatey, 0xcrazyboy999, 0xdoichantran, 0xhp9, 0xIconart, 0xlemon, 0xloscar01, 0xMosh, 0xTonraq, 0xvd, 0xyuri, 4B, Abdessamed, Abdul, agadzhalov, Agorist, aldarion, Alekso, Arjuna, arnie, attentioniayn, bani, Benterkiii, Bz, classic-k, Daniel_eth, Daniel526, dobrevaleri, doublekk, eLSeR17, EPSec, falconhoof, farismaulana, felconsec, francoHacker, gesha17, ginlee, HappyTop0603, hearmen, hearmen, Heavyweight_hunters, hyuunn, hyuunn, iam_emptyset, iamandreiski, Illoy-Scizceneghposter, inh3l, Ishenxx, jesjupyter, jsonDoge, ka14ar, kn0t, KupiaSec, lanyi2023, laxraw, leegh, matrix_0wl, misbahu, montecristo, MSK, Mylifechangefast_eth, MysteryAuditor, NHristov, PabloPerez, pairingfriendly, patitonar, peanuts, phoenixV110, REKCAH, Sabit, shaflow2, shaflow2, Sherlock__VARM, Shipkata494, silver_eth, SpicyMeatball, theboiledcorn, theboiledcorn, undefined_joe, vladi319, web3km, X0sauce, y4y, YouCrossTheLineAlfie, Zach_166, and zzykxx
https://github.com/code-423n4/2025-02-thorwallet/blob/98d7e936518ebd80e2029d782ffe763a3732a792/contracts/Titn.sol#L106-L108
https://github.com/code-423n4/2025-02-thorwallet/blob/98d7e936518ebd80e2029d782ffe763a3732a792/contracts/Titn.sol#L82-L83
 Root Cause
The Titn.sol contract incorrectly tracks bridged token holders using a boolean flag (isBridgedTokenHolder). Once an address receives any bridged tokens (via cross-chain bridging), it is permanently marked as a bridged token holder, subjecting all tokens held by that address (including non-bridged ones) to transfer restrictions. This flawed design allows malicious actors to disrupt legitimate users by sending them a trivial amount of bridged tokens, thereby locking their entire TITN balance from being transferred freely.
 Impact
 Code References
 Attack Scenario
 Coded Proof of Concept
./test/hardhat/Titn.test.ts
 Track Bridged Token Balances Instead of Booleans
 Benefits
cacaomatt (THORWallet) acknowledged
0xnev (judge) commented:
cacaomatt (THORWallet) acknowledged and commented:
For this audit, 9 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by Sparrow received the top score from the judge.
The following wardens also submitted reports: Anonymous0x1C41, EPSec, eta, Fitro, inh3l, peanuts, tpiliposian, and udo.
