Submission Details
Severity:
`TempleGold.send()` doesn't work if the payment token is `$ZRO`
## Summary
`TempleGold.send()` allows users to pay with `$ZRO` tokens (layerzero tokens) to bridge their `$TGLD` tokens, but this functionality is broken as the `TempleGold` contract doesn't approve the layerzero endpoint on the `$ZRO` payment token.
## Vulnerability Details
- Layerzero endpoint enables executing bridging calls while paying for gas either in native tokens or in `$ZRO` tokens (layerzero protocol tokens):
```javascript
function send(
SendParam calldata _sendParam,
MessagingFee calldata _fee,
address _refundAddress
)
external
payable
virtual
override(IOFT, OFTCore)
returns (MessagingReceipt memory msgReceipt, OFTReceipt memory oftReceipt)
{
if (_sendParam.composeMsg.length > 0) {
revert CannotCompose();
}
/// cast bytes32 to address
address _to = _sendParam.to.bytes32ToAddress();
/// @dev user can cross-chain transfer to self
if (msg.sender != _to) {
revert ITempleGold.NonTransferrable(msg.sender, _to);
}
// @dev Applies the token transfers regarding this send() operation.
// - amountSentLD is the amount in local decimals that was ACTUALLY sent/debited from the sender.
// - amountReceivedLD is the amount in local decimals that will be received/credited to the recipient on the remote OFT instance.
(uint256 amountSentLD, uint256 amountReceivedLD) = _debit(
msg.sender,
_sendParam.amountLD,
_sendParam.minAmountLD,
_sendParam.dstEid
);
// @dev Builds the options and OFT message to quote in the endpoint.
(bytes memory message, bytes memory options) = _buildMsgAndOptions(
_sendParam,
amountReceivedLD
);
// @dev Sends the message to the LayerZero endpoint and returns the LayerZero msg receipt.
msgReceipt = _lzSend(
_sendParam.dstEid,
message,
options,
_fee,
_refundAddress
);
// @dev Formulate the OFT receipt.
oftReceipt = OFTReceipt(amountSentLD, amountReceivedLD);
emit OFTSent(
msgReceipt.guid,
_sendParam.dstEid,
msg.sender,
amountSentLD,
amountReceivedLD
);
}
```
```javascript
struct MessagingFee {
uint nativeFee; // gas amount in native gas token
uint lzTokenFee; // gas amount in ZRO token
}
```
- But `TempleGold.send()` doesn't approve the authorized layerzero endpoint on the sent `$ZRO` tokens that are going to be used for gas substitute on the destination chain, resulting in failed bridging/broken functionality.
## Impact
Users can't bridge their `$TGLD` tokens using `$ZRO` tokens as a gas alternative.
## Tools Used
Manual Review.
## Recommendations
Update `TempleGold.send()` function to approve the authorized layerzero endpoint on the `$ZRO` tokens that is going to be used as gas payment.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.