MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Claim should estimate fees to prevent failed transactions

chainnue

Summary

Claim should estimate fees to prevent failed transactions

Vulnerability Details

When sending message to the LayerZero endpoint, it's essential to ensure that enough amount of gas is included for the transaction. If a user don't include enough tokens for the gas, the transaction will fail.

The Distribution::claim() function allows the user to pass any value they want which might result in them sending not enough. Thus their transaction will fail.

File: Distribution.sol
154: function claim(uint256 poolId_, address user_) external payable poolExists(poolId_) {
...
173: // Transfer rewards
174: L1Sender(l1Sender).sendMintMessage{value: msg.value}(user_, pendingRewards_, _msgSender());
177: }
​
File: L1Sender.sol
124: function sendMintMessage(address user_, uint256 amount_, address refundTo_) external payable onlyDistribution {
...
130: ILayerZeroEndpoint(config.gateway).send{value: msg.value}(
131: config.receiverChainId, // communicator LayerZero chainId
132: receiverAndSenderAddresses_, // send to this address to the communicator
133: payload_, // bytes payload
134: payable(refundTo_), // refund address
135: address(0x0), // future parameter
136: bytes("") // adapterParams (see "Advanced Features")
137: );
138: }

To know how much gas need to be send, there's an estimateFees() function as described here.

This issue is similar with previous audit on code4rena,
https://github.com/code-423n4/2022-05-velodrome-findings/issues/80

Impact

Failed to claim due to lack of gas fee calculation

Tools Used

Manual analysis

Recommendations

Consider to use the estimateFees() function and apply the msg.value check with it

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LayerZero Integration: `sendMintMessage` doesn't verify the `msg.value` sent by the user facilitating failed transactions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.