TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Failing to send enough gas in `TempleTeleporter::teleport` can lead to loss of funds

Triad of Trust

Summary

Failing to send enough gas in TempleTeleporter::teleport, so the receiving endpoint contract can execute the functions required, in this case mint will make the transaction revert on the destination chain.

Vulnerability Details

In TempleTeleporter::teleport, the gas amount to use is gathered from the user using TempleTeleport::quote. If the gas changes drastictly or the user passes in arbitrary amount to send that isn't enough to fulfill the actions on the receiving endpoint, the sending contract will execute it's actions, but the receiving contract will revert.

Impact

In the case of Temple, TempleTeleporter::teleport will burn the tokens on the sending contract, and mint them on the receiving contract. If the transaction reverts on the receiving contract, the user's tokens will be burnt but not minted on the receiving contract leading to loss of funds.

Here's a PoC add it into the test file TempleGoldLayerZero.t.sol

function testSendGas() public {
// gas that will fail
uint16 gasAmount = 2000;
uint256 tokensToSend = 1 ether;
bytes memory options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(gasAmount, 0);
SendParam memory sendParam = SendParam(
bEid,
addressToBytes32(userB),
tokensToSend,
tokensToSend,
options,
bytes("something"), // compose message
""
);
sendParam.composeMsg = "";
​
MessagingFee memory fee = aTempleGold.quoteSend(sendParam, false);
​
sendParam.to = addressToBytes32(userA);
​
vm.startPrank(userA);
try aTempleGold.send{ value: fee.nativeFee }(sendParam, fee, payable(address(this))) {
assertEq(aTempleGold.balanceOf(userA), initialBalance - tokensToSend);
assertEq(bTempleGold.balanceOf(userB), initialBalance);
assertEq(bTempleGold.balanceOf(userA), tokensToSend);
console.log("succeeded");
} catch {
console.log("failed");
}
verifyPackets(bEid, addressToBytes32(address(bTempleGold)));
}

Tools Used

Foundry

Recommendations

Add a minimum gas amount, or handle a refund mechanism incase of reverts happening to prevent loss of funds.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Fee validation issue in send

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.