Summary

The TempleGold contract restricts cross-chain transfers to be performed only on the same address, meaning the user must have the same address on the target chain. However, for smart wallets or smart contract-based wallets, users may have different account addresses on different chains.

Vulnerability Details

The Temple Gold token is minted exclusively on the Arbitrum chain. If you want to transfer it to another chain, you can do so via the LayerZero protocol. However, there is a restriction on cross-chain transfers: tokens can only be transferred to the same address on the target chain, as shown in the code below.

Tokens will only be transferred if msg.sender==_to , The user will not be able to send templeGold tokens, if msg.sender is a smart wallet and the owner does not have the same smart wallet address on the target chain.
lets consider following case :

1. Bob places a DAI bid in DaiGoldAuction via his smart contract base wallet address 0x123.

2. When the auction ends, Bob calls the claim function and receives 10e18 TempleGold tokens.

3. Now Bob wants to transfer these assets to the Ethereum Mainnet.

4. Bob calls the send function and tries to transfer TempleGold tokens to his other account 0x456 because the address 0x123 on Ethereum is not owned by him.

5. The transaction will always revert, and Bob will not be able to transfer the TempleGold tokens to the Ethereum Mainnet.

Impact

TempleGold is not compatible with smart wallets, and users will not be able to transfer tokens cross-chain if the token owner does not have the same wallet address on the target chain.

Tools Used

Manual Review.

Recommendation

Either allow users to send tokens to any address, or do not impose the msg.sender != _to check if msg.sender is a smart wallet or smart contract.