MorpheusAI

Summary

Refunds from LayerZero will be sent to the incorrect address, leading to a loss of assets for the users

Vulnerability Details

In the claim() function of Distribution.sol, pass msgSender() as refundTo to the sendMintMessage().
Refund address is wrongly passed as msg.sender.
Due to the way addresses are deviated on the different EVM chains, the refundee addresses would point to the wrong entities on the destination chains, leading to loss of tokens for the initiator of the bridge.
for smart contract wallets, the address on the destination chain is not necessarilly owned by the sender, meaning that refunded funds would end up locked.
You can read up more here: https://mirror.xyz/0xbuidlerdao.eth/lOE5VN-BHI0olGOXe27F0auviIuoSlnou_9t3XRJseY
And a previous report from a recent contest: code-423n4/2023-09-ondo-findings#406

Impact

Tools Used

Recommendations