Summary

The teleport function returns an inappropriate error message when a wrong token is used to pay fee.

Vulnerability Details

A native token is expected to be used to pay fees when a user calls the teleport function. However, when a non-native token is used, the function reverts.

https://github.com/Cyfrin/2024-07-templegold/blob/6c3980a0486c01114d0ef1281df188b6c01991e6/protocol/contracts/templegold/TempleTeleporter.sol#L57C19-L57C26

This is because the teleport function calls _lzSend function which in turn calls the _payNative function:

However, there is a wrong error message in the _payNative function that is returned when a wrong token is used as msg.value to pay fees:

if (msg.value != _nativeFee) revert NotEnoughNative(msg.value);

The error message would be "NotEnoughNative(msg.value); instead of something like "WrongToken(msg.value):

Impact

Misleading error message is displayed when the teleport function is called with a wrong token to pay fee. This misleads a user. A user would think the fee value sent is "NotEnough" when in actual sense, a wrong token was sent. This could cause temporal denial of service because a user would believe there isn't actually enough token sent as msg.value for the fee. And this could take a lot of time before a user discovers the actual cause of the issue.

Tools Used

Manual review

Recommendations

Appropriate error message should be displayed when a wrong token is used to pay fee.