MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`L1Sender:: sendMintMessage` do not follow Official LayerZero Integration Checklist

abhishekthakur

Summary

sendMintMessage do not follow the official checklist mentioned by layerzero.

Vulnerability Details

function sendMintMessage(address user_, uint256 amount_, address refundTo_) external payable onlyDistribution {
RewardTokenConfig storage config = rewardTokenConfig;
​
bytes memory receiverAndSenderAddresses_ = abi.encodePacked(config.receiver, address(this));
bytes memory payload_ = abi.encode(user_, amount_);
​
ILayerZeroEndpoint(config.gateway).send{value: msg.value}(
config.receiverChainId, // communicator LayerZero chainId
receiverAndSenderAddresses_, // send to this address to the communicator
payload_, // bytes payload
payable(refundTo_), // refund address
@> address(0x0), // future parameter
@> bytes("") // adapterParams (see "Advanced Features")
);
}

sendMintMessage has hardcoded adress(0x0) for zroPaymentAddress and similarly uses bytes(0) for adapterParams. Which is not a recommended practice. As this will prevent using ZRO token as fee which will be launching in coming future.
All checklist can be checked here. See point 5 and 7.

As keeping this values as params will be more useful for future updates, to have flexibility to use ZRO as fees.

Impact

composability issue with future updates, if layerzero introduced some breaking changes.

Tools Used

Manual Review

Recommendations

Add input params for zroPaymentAddress as well as for adapterParams as given below.

function sendMintMessage(address user_, uint256 amount_, address refundTo_
+ address zroPaymentAddress_, bytes calldata adapterParams_
) external payable onlyDistribution {
RewardTokenConfig storage config = rewardTokenConfig;
​
bytes memory receiverAndSenderAddresses_ = abi.encodePacked(config.receiver, address(this));
bytes memory payload_ = abi.encode(user_, amount_);
​
ILayerZeroEndpoint(config.gateway).send{value: msg.value}(
config.receiverChainId, // communicator LayerZero chainId
receiverAndSenderAddresses_, // send to this address to the communicator
payload_, // bytes payload
payable(refundTo_), // refund address
- address(0x0), // future parameter
- bytes("") // adapterParams (see "Advanced Features")
+ zroPaymentAddress_,
+ adapterParams_
);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
abhishekthakur Submitter
over 1 year ago
inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LayerZero Integration: Do not hardcode address zero (address(0)) as zroPaymentAddress

LayerZero Integration: Do not hardcode zero bytes (bytes(0)) as adapterParamers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.