Hardcoded `extraArgs` to empty bytes in `wrappedTokenBridge`
Summary
The issue lies in the hardcoded assignment of empty bytes to the extraArgs parameter during the bridging process of stLink tokens within the wrappedTokenBridge contract.
Vulnerability Details
The extraArgs in the CCIP message, as suggested by Chainlink's best practices, should be dynamic. Hardcoding empty bytes could lead to potential future issues, as these arguments might be utilized for different purposes. It's crucial to follow Chainlink's recommendations to ensure the flexibility and functionality of the application.
For more information, refer to Chainlink's best practices documentation.
Impact
Low
Tools Used
Manual review
Recommendations
Make extraArgs changable by the owner only. Just as other contracts do.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.