Layer zero endpoint can be blocked by malicious user
Summary
No way to unblock message channel if it is blocked or something unexpected happens.
Vulnerability Details
The ILayerZeroUserApplicationConfig interface which allows implementation of forceResumeReceive function for unblocking messages is not implemented as recommeded by Layer zero docs
Impact
LayerZero messaging between chains could get permanently blocked
Tools Used
Layer zero docs: https://layerzero.gitbook.io/docs/layerzero-tooling/best-practice#gas-for-message-types
Recommendations
As recommended by Layer zero implement the ILayerZeroUserApplicationConfig interface so as to implement forceResumeReceive function that in turn calls forceResumeReceive in the LayerZero Endpoint that enable the owner/multisig to unblock the queue of messages as recommended here: https://layerzero.gitbook.io/docs/layerzero-tooling/best-practice#gas-for-message-types
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.