Submission Details
Severity:
Function `getFee()` in `RESDLTokenBridge` can return wrong fee values to users
Summary
When a user tries to know how much tokens he should approve/transfer to the RESDLTokenBridge to bridge a lock, he can get a wrong amount
Vulnerability Details
In the current implementation, the fee calculation within the getFee function utilizes a hardcoded empty lock when determining the required fee for executing a CCIP message. This can lead to inaccurate quotes for users attempting to bridge their locks, potentially causing discrepancies in the amount needed for approval or transfer.
function getFee(uint64 _destinationChainSelector, bool _payNative) external view returns (uint256) {
Client.EVM2AnyMessage memory evm2AnyMessage = _buildCCIPMessage(
address(this),
0,
ISDLPool.RESDLToken(0, 0, 0, 0, 0), <-
address(this),
_payNative ? address(0) : address(linkToken),
extraArgsByChain[_destinationChainSelector]
);
return IRouterClient(sdlPoolCCIPController.getRouter()).getFee(_destinationChainSelector, evm2AnyMessage);
}
Impact
Low
Tools Used
Manual review
Recommendations
Compute the fee with the real values of the user's lock
- function getFee(uint64 _destinationChainSelector, bool _payNative) external view returns (uint256) {
+ function getFee(uint64 _destinationChainSelector, bool _payNative, uint256 _lockId) external view returns (uint256) {
+ uint256[] memory lockId = new uint256[](1);
+ lockId[0] = _lockId;
+ Lock[] memory locks = sdlPool.getLocks(lockId);
Client.EVM2AnyMessage memory evm2AnyMessage = _buildCCIPMessage(
address(this),
- 0,
+ _lockId,
- ISDLPool.RESDLToken(0, 0, 0, 0, 0),
+ locks[0]
address(this),
_payNative ? address(0) : address(linkToken),
extraArgsByChain[_destinationChainSelector]
);
return IRouterClient(sdlPoolCCIPController.getRouter()).getFee(_destinationChainSelector, evm2AnyMessage);
}
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.