Submission Details
Severity:
ETH sent to `outboundTransfer` could be lost
Summary
If a user send funds to outboundTransfer, the funds will be lost for ever. the function does not use the msg.value to perform any business logic.
Vulnerability Details
the function outboundTransfer only take into consideration the user _amount parameter to transfer tokens. However, this value may not represents the exact value sent in msg.value.
function outboundTransfer(
address _token,
address _to,
uint256 _amount,
uint256 _maxGas,
uint256 _gasPriceBid,
bytes calldata _data
) external payable returns (bytes memory) {
IERC20(_token).transferFrom(msg.sender, _to, _amount);
return abi.encode(_token, _to, _amount, _maxGas, _gasPriceBid, _data);
}
Impact
if a user send ETH to this function by accident, then all its ETH are lost forever.
Tools Used
Manual Audit
Recommendations
As the function does not use the msg.value to perform any business logic. therefore, there is no need for the outboundTransfer to be payable
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.