MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Project does not adhere to Layer zero intergration checklist

kaysoft

Summary

Layerzero recommended checklist is not adhered to on the User Application contracts.

Vulnerability Details

These are some of the checklists that where not implemented

  1. Do not hardcode address zero (address(0)) as zroPaymentAddress when estimating fees and sending messages. Pass it as a parameter instead.

Hardcoding the _zroPaymentAddress field to address(0) disallows the protocol from using ZRO token as a fee payment option in the future (ZRO might be launching soon). Consider passing the _zroPaymentAddress field as an input parameter to allow flexibility of future fee payments using ZRO tokens.

  1. Do not hardcode zero bytes (bytes(0)) as adapterParamers. Pass them as a parameter instead.

However in the L1Sender.sol contract, the above checklist were not implemented.

function sendMintMessage(address user_, uint256 amount_, address refundTo_) external payable onlyDistribution {
RewardTokenConfig storage config = rewardTokenConfig;
​
bytes memory receiverAndSenderAddresses_ = abi.encodePacked(config.receiver, address(this));
bytes memory payload_ = abi.encode(user_, amount_);
​
ILayerZeroEndpoint(config.gateway).send{value: msg.value}(
config.receiverChainId, // communicator LayerZero chainId
receiverAndSenderAddresses_, // send to this address to the communicator
payload_, // bytes payload
payable(refundTo_), // refund address
@> address(0x0), // future parameter
@> bytes("") // adapterParams (see "Advanced Features")
);
}

Impact

Not adhering to the checklist can lead to denial of service.

Tools Used

Manual Review

Recommendations

Implement the Layer zero checklist which can be found here: https://layerzero.gitbook.io/docs/troubleshooting/layerzero-integration-checklist

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LayerZero Integration: Do not hardcode address zero (address(0)) as zroPaymentAddress

LayerZero Integration: Do not hardcode zero bytes (bytes(0)) as adapterParamers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.