First Flight #12: Kitty Connect

Summary

Fees token address is currently hardcoded and does not allow users to select their preferred payment method.

Vulnerability Details

The function KittyBridge.sol::bridgeNftWithData() is responsible for preparing the message sent to the router. Currently, the address of the token used to pay the associated fees is hardcoded. However, according to Chainlink's Docs, fees can also be paid in the native asset by setting the value to the null address and sending the corresponding payment in the blockchain's native asset.

Impact

Users cannot decide their preferred payment method.

Tools Used

Manual review.

Recommendations

Do not hardcode the value and allow users to set it by themselves.