Submission Details
Severity:
`TempleTeleporter.teleport()` refunds gas to the wrong address in case of AA wallet
## Summary
`TempleTeleporter.teleport()` refunds gas for the wrong address in case users interact with the contract with AA wallet, as the `refundAddress` will be set to the `msg.sender` on the source chain that doesn't match the sender address on the destination chain.
## Vulnerability Details
The users send native tokens for gas fees to bridge their `$Temple`, and any extra gas will be refunded to to the `msg.sender` address on the destination chain:
```javascript
function teleport(
uint32 dstEid,
address to,
uint256 amount,
bytes calldata options
) external payable override returns (MessagingReceipt memory receipt) {
if (amount == 0) {
revert CommonEventsAndErrors.ExpectedNonZero();
}
if (to == address(0)) {
revert CommonEventsAndErrors.InvalidAddress();
}
// Encodes the message before invoking _lzSend.
bytes memory _payload = abi.encodePacked(to.addressToBytes32(), amount);
// debit
temple.burnFrom(msg.sender, amount);
emit TempleTeleported(dstEid, msg.sender, to, amount);
receipt = _lzSend(
dstEid,
_payload,
options,
MessagingFee(msg.value, 0),
payable(msg.sender) // @audit-issue : this is the refundAddress on the destination chain
);
}
```
- As can be noticed, the `refundAddress` is set to the `msg.sender`, but there's an issue with this as users who bridge their `$Temple` tokens with "EOAs" (externally owned accounts) will be using the same address that is created on all evm chains for these accounts, but users of **account abstraction wallets** (which are unique smart contract instances deployed on individual chains) will have different addresses on different chains.
## Impact
This will result in sending refunded gas to a wrong address in the destination chain.
## Tools Used
Manual Review.
## Recommendations
Update `TempleGold.teleport()` function to enable users from determining the `refundAddress` on the destination chain:
```diff
function teleport(
uint32 dstEid,
address to,
uint256 amount,
bytes calldata options,
+ address refundAddress
) external payable override returns (MessagingReceipt memory receipt) {
//....
receipt = _lzSend(
dstEid,
_payload,
options,
MessagingFee(msg.value, 0),
- payable(msg.sender)
+ refundAddress
);
}
```
Updates
Lead Judging Commences
inallhonesty
about 1 year ago
inallhonesty about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Hardcoding the `refundAddress` to `payable(msg.sender)` might lead to stuck fees in case of contracts that don't expect them.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.