Summary

There is no checking on the provided value in the teleport function, which allows the user to provide any value.

Vulnerability Details

User should call quote to get recommended fee, and then provide required value while calling teleport function. But because that value is not checked anywhere it might lead to situation where user provides to low, or to big value. You will find more details in the links below.

Value is too low: https://docs.layerzero.network/v2/developers/evm/gas-settings/tx-pricing#message-execution-options

Value is too high: https://docs.layerzero.network/v2/developers/evm/gas-settings/options#add-options-types

Impact

The transaction might be reverted, or be stalled on the destination chain.

Tools Used

Manual Review

Recommendations

Layerzero documentation suggest to provide some gas buffer. More details can be found in provided links