stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The `extraArgs` parameter used in the `WrappedTokenBridge::_buildCCIPMessage` should be mutable in order to allow compatibility with future CCIP upgrade

0xbepresent

Summary

The extraArgs parameter used in the WrappedTokenBridge::_buildCCIPMessage function should be mutable in order to allow compatibility with future CCIP upgrade.

Vulnerability Details

The parameter extraArgs helps to specify the gasLimit, in the other hand if there is a transfer of tokens directly to an EOA the value can be zero.

The problem is that inside the function WrappedTokenBridge::_buildCCIPMessage an immutable extraArgs is used (code line 223), which can be harmful since in order to have compatibility with CCIP updates it is necessary for extraArgs to be mutable.

File: WrappedTokenBridge.sol
210: function _buildCCIPMessage(
211: address _receiver,
212: uint256 _amount,
213: address _feeTokenAddress
214: ) internal view returns (Client.EVM2AnyMessage memory) {
215: Client.EVMTokenAmount[] memory tokenAmounts = new Client.EVMTokenAmount[](1);
216: Client.EVMTokenAmount memory tokenAmount = Client.EVMTokenAmount({token: address(wrappedToken), amount: _amount});
217: tokenAmounts[0] = tokenAmount;
218:
219: Client.EVM2AnyMessage memory evm2AnyMessage = Client.EVM2AnyMessage({
220: receiver: abi.encode(_receiver),
221: data: "",
222: tokenAmounts: tokenAmounts,
223: extraArgs: "0x",
224: feeToken: _feeTokenAddress
225: });
226:
227: return evm2AnyMessage;
228: }

According to CCIP documentation:

The purpose of extraArgs is to allow compatibility with future CCIP upgrades. To get this benefit, make sure that extraArgs is mutable in production deployments.

Impact

Compatibility problems may exist in CCIP updates if extraArgs remains immutable.

Tools used

Manual review

Recommendations

Add appropriate modifications to be able to change extraArgs if necessary.

Updates

Lead Judging Commences

0kage Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.