gaslimit value given is very high. Can lead to loss of funds for Users as remaining gas is not refundable from Receiver from other chain.
Summary
gasLimit is given as 400000 but actually the total gas limit required is very less to execute the function _ccipReceive (260459).
Vulnerability Details
We need to note that the remaining gas will not be returned back from CCIP.
Impact
There is a loss of some funds for NFT Owners when they bridge NFT to another chain
Tools Used
VS Code
Foundry Tests
Recommendations
Identify the gas limit required to execute the function _ccipReceive and set the default base value of Gas limit accordingly. However due to traffic conditions it might increase - so good option will be to allow users to set the gas limit when they execute the bridgeNFT transaction. User beforehand can calculate what will be gas limit (we need to provide option in front end) and then user can pass the gaslimit as extra parameter in bridgeNftToAnotherChain() function. If no gas limit is provided then use default base value.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.