MorpheusAI

Vulnerability Details

When sending a msg to the layer zero endpoint you include enough gas for the transaction. If you don't include enough tokens for the gas, the transaction will fail. The L1Sender contract allows the user to pass any value they want which might result in them sending not enough. Their transaction will fail.

To know how much you have to send there's the estimateFees() function as described here:
https://layerzero.gitbook.io/docs/evm-guides/contract-standards/estimating-message-fees

Tools Used

Manual Review

Recommendations

Use the estimateFees() endpoint to estimate fee and enforce the following check:

require(msg.sender >= estimatedFee, "Less Fee");