Summary

The depositTokens function in the L1 to L2 bridge contract does not implement any mechanism to refund excess msg.value if a user sends more than the fixed fee.

Vulnerability Details

The depositTokens function allows users to send ether (msg.value) along with their transaction. This ether is intended to cover the fee for sending a message from the L1 contract to the L2 contract. However, the contract lacks logic to enforce that msg.value equals the fixed fee or to refund any excess value provided by the user.

The entire amount of ether sent by the user (msg.value) is used to cover the messaging fee when calling the sendMessageToL2 function in the StarknetCore contract.

If a user sends more ether than the fixed fee, the excess is not refunded. The contract does not calculate the difference between the fee and the provided msg.value or handle any refunds.

Impact

Since there is no refund mechanism, the excess ether remains locked in the Starknet Core contract without any means for users to reclaim it.

Tools Used

Manual Review

Recommendations

Implement Refund Logic for Excess Payment