TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`TempleTeleporter._lzReceive` assumes `to` address length incorrectly.

qpzm

Summary

TempleTeleporter._lzReceive assumes to address length incorrectly.

Vulnerability Details

TempleTeleporter.send converts to in the message from 20 bytes to 32 bytes.

address _to = _sendParam.to.bytes32ToAddress();

https://github.com/Cyfrin/2024-07-templegold/blob/6873abd52ddee3502fdefd95b83304687feb515b/protocol/contracts/fakes/templegold/TempleGoldMock.sol#L121

However, TempleTeleporter._lzReceive assumes that to is 20 bytes.

(address _recipient, uint256 _amount) = abi.decode(_payload, (address, uint256));

https://github.com/Cyfrin/2024-07-templegold/blob/6873abd52ddee3502fdefd95b83304687feb515b/protocol/contracts/templegold/TempleTeleporter.sol#L107

Impact

abi.decode(_payload, (address, uint256)) will revert because it tries converting 64-byte_payload into (20 + 32)
bytes.

Tools Used

Manual review

Recommendations

LayerZero uses bytes32 for broad compatibility with non-EVM chains. Therefore, keep the to address as bytes32 in the message.

- (address _recipient, uint256 _amount) = abi.decode(_payload, (address, uint256));
+ (bytes32 _recipientBytes, uint256 _amount) = abi.decode(_payload, (bytes32, uint256));
+ address _recipient = _recipientBytes.bytes32ToAddress();

https://github.com/Cyfrin/2024-07-templegold/blob/6873abd52ddee3502fdefd95b83304687feb515b/protocol/contracts/templegold/TempleTeleporter.sol#L107

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

`abi.encodePacked` to encode it while on the recieving it uses `abi.decode()` to decode the payload and it doesn't work like that

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.