First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

'KittyBridge.sol::bridgeNftWithData' Does not give permissions to the Router to transfer LINK tokens

coffee

Summary

In the 'KittyBridge.sol::bridgeNftWithData' function; before calling 'router.ccipSend', the Router contract is not given approval to transfer LINK tokens.

Vulnerability Details

As per the Chainlink CCIP documentation, the Router contract must be given permission to transfer LINK tokens. This is to ensure that the fees in LINK will be paid.

Below is the missing line as per the CCIP documentation

// approve the Router to transfer LINK tokens on contract's behalf. It will spend the fees in LINK
s_linkToken.approve(address(router), fees);

Impact

The 'KittyBridge.sol::bridgeNftWithData' function is missing the line to approve the Router to transfer LINK tokens. Without this approval, fees will not be able to be deducted from the contract's LINK balance.

if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(s_linkToken.balanceOf(address(this)), fees);
}
@>
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
​
emit MessageSent(messageId, _destinationChainSelector, _receiver, _data, address(s_linkToken), fees);

Tools Used

--Foundry

Recommendations

It is recommended to add the below line to allow the Router contract to transfer LINK tokens.

if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(s_linkToken.balanceOf(address(this)), fees);
}
​
+ s_linkToken.approve(address(router), fees);
​
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
​
emit MessageSent(messageId, _destinationChainSelector, _receiver, _data, address(s_linkToken), fees);
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing fee token approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.