MorpheusAI

Summary

When a transaction fails, the transaction can be retried to clear up the message queue. Doing this requires anyone to call the retryMessage function so as to free up the queue. The function however, doesn't follow CEI, making it vulnerable to a reentrancy, from which a malicious users can excessively mint MOR tokens.

Vulnerability Details

To free up the message queue, the user calls the retryMessage function. Note the function arrangement.

The function performs the required checks, then calls the _nonblockingLzReceive function, upon which MOR tokens are minted to the user through the external mint function in the MOR.sol contract.

By creating a contract that can repeatedly call the retryMessage function, the MOR tokens can be repeatedly minted, before the failedMessage's params are deleted.

Impact

Excessive minting of MOR tokens.

Tools Used

Manual Code Review

Recommendations

Follow the CEI pattern or add a reentrancy guard.
Note that the original implementation of the retryMessge function also deletes the failed messages before making the call to the _nonblockingLzReceive function.