stake.link

Summary

The ccipReceive function in the SDLPoolCCIPController is designed to forward messages to reSDLTokenBridge based on assumptions about the destination tokens. However, the code makes an assumption that the zeroth index of destTokenAmounts[0].token will always be equal to address(sdlToken). This assumption could lead to potential issues if the logic evolves and more cases are introduced in the future.

Vulnerability Details

The function currently checks if there is only one destination token, and if that token is sdlToken, it forwards the message to reSDLTokenBridge. This rigid handling assumes a fixed structure in the destTokenAmounts array, specifically that sdlToken will always be at the zeroth index. If this assumption is violated, unintended consequences could arise.

Impact

The impact of this issue is moderate. If the assumption about the zeroth index is not maintained, the condition checking for sdlToken at the zeroth index may not hold, and the function could behave unexpectedly. This could potentially lead to incorrect handling of destination tokens.

Tools Used

Manual review.

Recommendations

Flexible Handling: Modify the function to handle multiple destination tokens in a more flexible and extensible way. Implement a loop to iterate through destTokenAmounts and handle each token individually.

Documentation: Clearly document the logic and assumptions in the code, especially if there are specific expectations regarding the zeroth index of destTokenAmounts. Ensure that future developers or maintainers understand the intended behavior and are aware of any assumptions made.