Overlayer Disclosed Report

A cross-chain accounting flaw in OverlayerWrapCore causes destination-side credit operations to revert because totalBridgedOut is tracked locally per chain but assumed to be global.

PoC Result (Verified): A runnable Hardhat PoC was executed successfully.

• Source-side debit succeeds
• totalBridgedOut increases on source
• Destination totalBridgedOut remains zero
• Destination credit reverts (confirmed)

This causes deterministic failure of cross-chain fund delivery. Funds may become stuck depending on bridge recovery logic.

Technical Root Cause: totalBridgedOut += amount (source) totalBridgedOut -= amount (destination)

Destination state is zero → underflow → revert.