TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Parameters passed in the `quote` is not identical to what used in `lzSend` , can break cross chain functionality.

unRekt

Summary

Parameters passed in the quote is not identical to what used in lzSend , can break cross chain functionality.

Vulnerability Details

Make sure that the arguments passed into the `quote()` function identically match the parameters used in the `lzSend()` function.
If parameters mismatch, you may run into errors as your `msg.value` will not match the actual gas quote.

The above text is taken from LayerZero documentation, as per their recommendation the parameters of quote() function identically match the parameters used in the lzSend() function.
But here as we can see below

receipt = _lzSend(dstEid, _payload, options, MessagingFee(msg.value, 0), payable(msg.sender));
function quote(
uint32 _dstEid,
bytes memory _message,
bytes memory _options
) external view returns (MessagingFee memory fee) {
return _quote(_dstEid, _message, _options, false);
}
function quote(
uint32 _dstEid,
address _to,
uint256 _amount,
bytes memory _options
) external view returns (MessagingFee memory fee) {
return _quote(_dstEid, abi.encodePacked(_to, _amount), _options, false);
}

The parameters passed in quote and lzSend are different.
LayerZero documentation

Impact

According to LayerZero, if parameters mismatch, you may run into errors as your msg.value will not match the actual gas quote.

Tools Used

Manual review

Recommended Mitigation

Make sure that the arguments passed into the quote() function identically match the parameters used in the lzSend() function, by LayerZero.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect payload bytes in `quote()` they use `abi.encodePacked(_to, _amount)` instead of `abi.encodePacked(_to.addressToBytes32(), _amount)`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.