stake.link

Summary

The WrappedTokenBridge contract exhibits a critical issue in its fee calculation logic. Specifically, the getFee function uses a hardcoded value of 1000 ether, leading to potentially incorrect fee assessments for CCIP transfers. As the router from chainlink also accounts for the amount of tokens to determine the charged fee.

Vulnerability Details

The problem lies in the getFee function where it constructs a Client.EVM2AnyMessage with a hardcoded 1000 ether amount. This approach does not accurately reflect the dynamic nature of fee calculations, which should consider the actual amount of tokens being transferred.

Impact

This hardcoded value can result in incorrect fee estimations, potentially leading to overcharging or undercharging users for CCIP transfers. This issue undermines the reliability and trustworthiness of the fee assessment mechanism in the contract.

Tools Used

Manual Review

Recommendations

Revise the getFee function to dynamically calculate fees based on the actual token amount being transferred. Ensure that the fee computation aligns with the varying amounts and conditions of each transfer, providing an accurate and fair fee estimation for users.