stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No fee limit for setMaxLINKFee

saaj

Summary

The fees in SDLPoolCCIPController can be set arbitrarily high or no fee at all as there exists no restriction in setMaxLINKFee .

Vulnerability Details

setMaxLINKFee does not have any check to prevent setting zero value or a very high fee for the protocol which can lead to loss for protocol and user in either case.

Impact

The owner can set a huge fee for sending CCIP message so that a user will be charged very high for sending a CCIP message in return or set the zero value in which protocol get nothing and cause loss to protocol and user in above considered scenario.

Tools Used

Manual review

Recommendations

The recommendation is made to have check in function to prevent setting value to zero as well as have a max fee limit i.e.; 5 or 10 link when fees are set for sending CCIP message.

function setMaxLINKFee(uint256 _maxLINKFee) external onlyOwner {
+ require(_maxLINKFee <= 10, “fee is too high”);
+ require(_maxLINKFee!= 0, “fee cannot be zero”);
maxLINKFee = _maxLINKFee;
}
Updates

Lead Judging Commences

0kage Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.