TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`TempleTeleporter` uses hardcoded value for `zero token amount as fees` , which makes users to pay fees in `native gas token` only

abhishekthakur

Summary

Relevant link - https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/TempleTeleporter.sol#L43-L58

TempleTeleport don't have functionality to provide user a flexible approach to use ZRO token as fees in future (that could be introduced soon as token is live already). Currently it's set to use native gas only, as ZRO amount is hardcoded to 0.

Vulnerability Details

function teleport(
uint32 dstEid,
address to,
uint256 amount,
bytes calldata options
) external payable override returns(MessagingReceipt memory receipt) {
if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
if (to == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
// Encodes the message before invoking _lzSend.
bytes memory _payload = abi.encodePacked(to.addressToBytes32(), amount);
// debit
temple.burnFrom(msg.sender, amount);
emit TempleTeleported(dstEid, msg.sender, to, amount);
​
@> receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, 0), payable(msg.sender));
}
​

Layerzero provides users a option to use either eth or zro as fees for bridging. This is essential for future implementation when zero token is integrated by layerzero protocol with given V2 endpoints. Using layerzero token as fees, might be beneficial in future, than native eth.

However, if you check the highlighted line MessagingFee(msg.value, 0), it hardcode the ZRO token amount to 0. Means users won't be able to use zro token as fees in future, even if it's introduced by the layerzero.

Impact

It doesn't affect the protocol, although users may miss the opportunity to use ZRO token as fees in future.

Tools Used

Manual Review

Recommendations

Consider, having a input for ZRO token amount, so whenever it goes live users can use it.

​
function teleport(
uint32 dstEid,
address to,
uint256 amount,
+ uint256 zroAmount,
bytes calldata options
) external payable override returns(MessagingReceipt memory receipt) {
if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
if (to == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
// Encodes the message before invoking _lzSend.
bytes memory _payload = abi.encodePacked(to.addressToBytes32(), amount);
// debit
temple.burnFrom(msg.sender, amount);
emit TempleTeleported(dstEid, msg.sender, to, amount);
- receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, 0), payable(msg.sender));
+ receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, zroAmount), payable(msg.sender));
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.