stake.link

Summary

WrappedTokenBridge is using Hardcoded extraArgs which is not suitable for production

Vulnerability Details

based on chainlink docs, there is an exclamation mark saying this is important, not a suggestion

It also mentioned, for production, we need to make sure extraArgs is mutable not immutable or hardcoded value. This allows project to build it offchain and pass it in a call to a function or store it in a variable that can be update on-demand. The purpose of extraArgs is to allow compatibility with future CCIP upgrades.

Other contract do have a mutable extraArgs but only on WrappedTokenBridge it is hardcoded with 0x.

Impact

If Chainlink CCIP upgrade its contract and requiring specific value on extraArgs as mentioned in their docs, it would break the CCIP

Tools Used

Manual analysis

Recommendations

Make extraArgs in WrappedTokenBridge mutable just like other contract