First Flight #12: Kitty Connect
First Flight #12: Kitty Connect
Beginner FriendlyFoundryNFTGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`KittyBridge::bridgeNftWithData` is missing an `IERC20::approve` for the router client, preventing the transfer of `feeToken` for the payment of the CCIP fees

pataroff

Description

The KittyBridge::bridgeNftWithData function is missing an approve call to authorize spending of the given feeToken on behalf of the router client, preventing the transfer of the fees required to send the CCIP message to the destination chain.

Impact

Without the approve call, the contract is unable to authorize the router client to spend the feeToken, thus preventing the transfer of fees required for the CCIP message. As a result, the intended cross-chain message will fail to be sent, leading to severe disruption of the contract's functionality.

Recommended Mitigation

Make an approval to the router client for the fees amount, before sending the CCIP message.

function bridgeNftWithData(uint64 _destinationChainSelector, address _receiver, bytes memory _data)
external
onlyAllowlistedDestinationChain(_destinationChainSelector)
validateReceiver(_receiver)
returns (bytes32 messageId)
{
// Create an EVM2AnyMessage struct in memory with necessary information for sending a cross-chain message
Client.EVM2AnyMessage memory evm2AnyMessage = _buildCCIPMessage(_receiver, _data, address(s_linkToken));
​
// Initialize a router client instance to interact with cross-chain router
IRouterClient router = IRouterClient(this.getRouter());
​
// Get the fee required to send the CCIP message
uint256 fees = router.getFee(_destinationChainSelector, evm2AnyMessage);
​
if (fees > s_linkToken.balanceOf(address(this))) {
revert KittyBridge__NotEnoughBalance(s_linkToken.balanceOf(address(this)), fees);
}
​
+ s_linkToken.approve(address(router), fees);
​
messageId = router.ccipSend(_destinationChainSelector, evm2AnyMessage);
​
emit MessageSent(messageId, _destinationChainSelector, _receiver, _data, address(s_linkToken), fees);
​
return messageId;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing fee token approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.