User enter data in TempleGold::send is not inspected
Summary
There is an option to inspect the user provided data by msgInspector in _buildMsgAndOptions(). however, this function doesn't take advantage of it. Consider inspecting message and options, especially since the params are set by external users. If msgInspector is not set before user attempts to send token, message and options, is set to bytes(0) i.e. default bytes values. Note that msgInspector is not set at deployment and will have to be set as a seperate Tx.
This may lead to unforeseen issues that could have been prevented by inspection
https://github.com/Cyfrin/2024-07-templegold/blob/da199ee9316665e3ea9006ce9c9f5a7fd7cbc605/protocol/contracts/templegold/TempleGold.sol#L303
Recommendations
Consider inspecting the users' provided data for extra layer of security.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.