Submission Details
Severity:
`KittyBridge::bridgeNftWithData` doesn't approve fee token, causing CCIP to revert
Description
In the bridgeNftWithData function of the KittyBridge contract, there is no approval of fee tokens before calling the ccipSend function. According to the Chainlink CCIP documentation, the bridge contract needs to own and approve LINK tokens to use the CCIP product. Without this approval, CCIP will revert, making it impossible to bridge any token.
function bridgeNftWithData(
...
)
...
{
...
uint256 fees = router.getFee(_destinationChainSelector, evm2AnyMessage);
if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(
s_linkToken.balanceOf(address(this)),
fees
);
}
@>
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
emit MessageSent(
messageId,
_destinationChainSelector,
_receiver,
_data,
address(s_linkToken),
fees
);
return messageId;
}
Risk
Likelyhood:
Occurs with every bridge.
Impact:
Impossible to bridge NFTs.
Proof of Concept
Attempt to bridge any NFT via the Chainlink Testnet.
Recommended Mitigation
Add approval of the fee tokens in the function:
function bridgeNftWithData(
...
)
...
{
...
uint256 fees = router.getFee(_destinationChainSelector, evm2AnyMessage);
if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(
s_linkToken.balanceOf(address(this)),
fees
);
}
+ s_linkToken.approve(address(router), fees);
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
emit MessageSent(
messageId,
_destinationChainSelector,
_receiver,
_data,
address(s_linkToken),
fees
);
return messageId;
}
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Missing fee token approval
Rewards breakdown
nSLOC
235This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.