stake.link

Summary

In WrappedTokenBridge there is mess with ccip message receiver and wrapped tokens receiver.

Vulnerability Details

User provided receiver is intended to be receiver of wrapped tokens on distanation chain.

But this address go first to _transferTokens function and then to _buildCCIPMessage where it set as EVM2AnyMessage.receiver which is ccip message receiver on destanation chain, not wrapped token receiver.

This message intented to be delivered to same WrappedTokenBridge contract on destination chain and handled in this function. In this function actual wrapped token receiver is decoded from message data, but this data is empty

Impact

WrappedTokenBridge contract unable to perform intended function. High severity because user will loss tokens sended through this bridge.

Tools Used

Manual review

Recommendations

Encode user provided receiver address to message data and set WrappedTokenBridge contract on destination chain as message receiver. You need to keep track of these contracts on all supported chain.