TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`Smart Accounts` aka `ERC4337 wallets` won't be able to participate in cross chain `Reverse Spice Auction` due to denial of service while bridging `TGLD`

abhishekthakur

Summary

TGLD do not support cross chain transfer for Smart Wallet users as per current logic. Smart Accounts have different address on each chain, and current cross chain logic only allows same address to be on all chains.

Vulnerability Details

Relevant link - https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/TempleGold.sol#L281-L300

function send(
SendParam calldata _sendParam,
MessagingFee calldata _fee,
address _refundAddress
) external payable virtual override(IOFT, OFTCore) returns (MessagingReceipt memory msgReceipt, OFTReceipt memory oftReceipt) {
if (_sendParam.composeMsg.length > 0) { revert CannotCompose(); }
/// cast bytes32 to address
address _to = _sendParam.to.bytes32ToAddress();
/// @dev user can cross-chain transfer to self
/// @audit - This prevents smart wallets to move TGLD Cross chains, if sent to same `to`
/// they will loose the TGLD
@> if (msg.sender != _to) { revert ITempleGold.NonTransferrable(msg.sender, _to); }
​
// @dev Applies the token transfers regarding this send() operation.
// - amountSentLD is the amount in local decimals that was ACTUALLY sent/debited from the sender.
// - amountReceivedLD is the amount in local decimals that will be received/credited to the recipient on the remote OFT instance.
(uint256 amountSentLD, uint256 amountReceivedLD) = _debit(
msg.sender,
_sendParam.amountLD,
_sendParam.minAmountLD,
_sendParam.dstEid
);

If you check the highlighted line, it enforced the to must be msg.sender , It works well for EOA's. However smart accounts aka ERC4337 wallets have different address on each chain most of the time.

With over 9.6 Million smart wallets and over 100 billion assets stored in them, and increasing usage of it day by day, there is high chance that there will users will have smart wallets for TGLD. This will be an issue as, the current logic will prevent smart account users to bridge TGLD to other chains like ETH, which could have been better for them, to participate in cross chain spice auction to get same incentive as other EOA's.

Impact

Smart accounts users are forced to stuck on same chain, missing the opportunity that other EOA's will be getting like participating in reverse spice chain auction on eth. If sent to same address, they will loose there TGLD to someone else.

Tools Used

Manual Review

Recommendations

As TGLD is by default non-transferrable, so minting it cross to any to address should not affect the protocol.
Alternatively, it should be shown on front end app, that smart accounts wallet won't be able to move cross chain.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Account abstraction, Multisig, Any other contract based solution that doesn't share the same address across chains will lose it's TGLD in teleport.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.