MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Hardcoded '_zroPaymentAddress' field to 'address(0)' disallows future ZRO fee payments and allows the possibility of L1Sender.sol falling apart in case LayerZero makes breaking changes

denzi

Summary

Hardcoding the _zroPaymentAddress in the L1Sender::sendMintMessage function disallows the protocol from using ZRO token as a fee payment option furthermore if any updates are made by the LayerZero team then there are possibilities for the protocol's core functionality breaking down.

Vulnerability Details

The following line of code is responsible.

ILayerZeroEndpoint(config.gateway).send{value: msg.value}(
config.receiverChainId, // communicator LayerZero chainId
receiverAndSenderAddresses_, // send to this address to the communicator
payload_, // bytes payload
payable(refundTo_), // refund address
-> address(0x0), // future parameter
bytes("") // adapterParams (see "Advanced Features")
);

LayerZero team has provided an integration checklist To ensure smooth integration and maximum flexibility.
https://layerzero.gitbook.io/docs/troubleshooting/layerzero-integration-checklist

See point 5 in the checklist:

Do not hardcode address zero (address(0)) as zroPaymentAddress when estimating fees and sending messages. Pass it as a parameter instead.

Currently the protocol is not following the checklist defined by LayerZero team according to point 5.

Impact

User's will not be allowed to use ZRO tokens as fee payments and there are chances for the core functionality of the protocol to break down if LayerZero makes changes which breaks the protocol's functionality. Therefore a checklist has been provided by the LayerZero Team.

Tools Used

Manual Review, Solodit

Recommendations

Consider passing _zroPaymentAddress field as an input parameter to allow flexibility of future fee payments using ZRO tokens as mentioned in the checklist.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LayerZero Integration: Do not hardcode address zero (address(0)) as zroPaymentAddress

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.