mediumLogic errorEVM-Solidity
DODO Cross-Chain DEX: Wrong encoding of `BTC` receiver in revert options
- Payout
- $0
- Protocol
- DODO Cross-Chain DEX
- Disclosed
- Jun 9, 2025
- Source
- sherlock
In DODO's cross-chain gateway, when a user withdraws zBTC back to a native Bitcoin address, the contract casts the receiver from a bytes payload to 20 bytes when constructing the revert options. Bitcoin addresses (bech32) are longer than 20 bytes, so this trun …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.