TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

no checks present to ensure if `amount` is enough to cover completing execution and the transfer by endpoint and on the destination chain, can lead to silent failure

unRekt

Summary

No checks present to ensure amount is enough for covering transaction costs.

Vulnerability Details

In teleport function of TempleTeleporter.sol the comment above the function says -

Enough msg.value needs to be sent through to cover completing execution and the transfer by endpoint and on the destination chain.

So the user need to send appropriate amount of funds in order to complete the execution,
In the teleport function checks are present to ensure amount sent is not zero here-

if (to == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }

But no checks are present to ensure that amount sent is enough to cover the execution cost.

Impact

If amount sent is less than the execution cost required for transaction then it can lead to silent failures.

Code snippet

function teleport(
uint32 dstEid,
address to,
uint256 amount,
bytes calldata options
) external payable override returns(MessagingReceipt memory receipt) {
if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
if (to == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
// Encodes the message before invoking _lzSend.
bytes memory _payload = abi.encodePacked(to.addressToBytes32(), amount);
// debit
temple.burnFrom(msg.sender, amount);
emit TempleTeleported(dstEid, msg.sender, to, amount);
​
receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, 0), payable(msg.sender));
}

Tools Used

Manual review

Recommendations

Implement checks to ensure amount sent is enough to cover transaction costs.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Fee validation issue in send

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.