Submission Details
Severity:
``retryMessage()`` of L2MessageReceiver.sol should implement a try-catch block.
Summary
retryMessage() of L2MessageReceiver.sol should implement a try-catch block.
Vulnerability Details
The retryMessage() of L2MessageReceiver.sol is used to retry messages which are failed in _blockingLzReceive(). But retry is only possible once as retryMessage() deletes the failedMessages data mapping even if retry message fails.
./L2MessageReceiver.sol#Line64
delete failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
Impact
User should be able to retry message for as many times as possible. Also, retry message may fail due to some technical or external issues.
Tools Used
Manual Analysis
Recommendations
Implement try-catch block in retryMessage().
function retryMessage(
uint16 senderChainId_,
bytes memory senderAndReceiverAddresses_,
uint64 nonce_,
bytes memory payload_
) external {
bytes32 payloadHash_ = failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
require(payloadHash_ != bytes32(0), "L2MR: no stored message");
require(keccak256(payload_) == payloadHash_, "L2MR: invalid payload");
try IL2MessageReceiver(address(this)).nonblockingLzReceive(
senderChainId_, senderAndReceiverAddresses_, payload_
) {
delete failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
emit RetryMessageSuccess(senderChainId_, senderAndReceiverAddresses_, nonce_, payload_);
} catch {
emit RetryMessageFailure(senderChainId_, senderAndReceiverAddresses_, nonce_, payload_);
}
}
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.