stake.link

Summary

Reading the CCIP documentation, it says "Do not hardcode extraArgs". To accommodate future CCIP upgrades, extraArgs must be modifiable.(https://docs.chain.link/ccip/getting-started).
Looking at the CCIP errors, I see "InvalidExtraArgsTag", which means that the extraArgs hardcoded in this contract may cause an error in the future.(https://docs.chain.link/ccip/api-reference/errors).
In that case, this contract will not be able to send CCIP messages and will become useless, which is dangerous.

Vulnerability Details

extraArgs are hardcoded in the following locations.

https://github.com/Cyfrin/2023-12-stake-link/blob/549b2b8c4a5b841686fceb9c311dca9ac58225df/contracts/core/ccip/WrappedTokenBridge.sol#L223

Impact

Critical functionality could be compromised, rendering the contract unusable.

Tools Used

Manual

Recommendations

Allow extraArgs to be changed by the setter function.