TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

certain contracts will not be able to user the teleport function if they are not payable bricking the crosschain send

arnie

Summary

certain contracts will not be able to user the teleport function if they are not payable bricking the crosschain send

Vulnerability Detail

in the teleport function, the user is not able to specify the refunnd addresss, this address is set to the msg.sender

function teleport(
uint32 dstEid,
address to,
uint256 amount,
bytes calldata options
) external payable override returns(MessagingReceipt memory receipt) {
if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
if (to == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
// Encodes the message before invoking _lzSend.
bytes memory _payload = abi.encodePacked(to.addressToBytes32(), amount);
// debit
temple.burnFrom(msg.sender, amount);
emit TempleTeleported(dstEid, msg.sender, to, amount);
​
receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, 0), payable(msg.sender));
}

as we can see above the user wil be unable to specify the refund address. If the holder of temple tokens happens to be a contract with no payable or receive functions, it will be unable to send its temple tokens crosschain because when the lzsend function attempts to refund excess Fee, the tx will revert because of the lack of any receive functions on the user's contract.

Therefore the function is not compatible with certain smart contracts

Impact

Certain users will be unable to send their temple tokens cross chain

Code Snippet

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/TempleTeleporter.sol#L43

Tool used

Manual Review

Recommendation

allow users to specify a refund address that way they can send temple tokens cross chain if the holder of temple tokens is a smart contract with no receive

Updates

Lead Judging Commences

inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Hardcoding the `refundAddress` to `payable(msg.sender)` might lead to stuck fees in case of contracts that don't expect them.

Appeal created

arnie Submitter
12 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Hardcoding the `refundAddress` to `payable(msg.sender)` might lead to stuck fees in case of contracts that don't expect them.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.