Anyone can override the handler records.

[0xdcota]

[H-5] Anyone can override the handler records using the same trasnferId and failing bundle

Description

If try this.xBundle(actions, args) fails inside xReceive of the router, and the contract has dormant funds; a record is made inside the handler in the name of transferId, and funds are transferred there.

However, since anyone can call xReceive, one can call it with the same transferId later, make the bundle fail on purpose, and override the content inside the handler.

Remediation

Consider quering connext to check if the transferId passed is already processed.