Submission Details
Severity:
Smart contracts may bypass the teleport restriction
Summary
TempleGold.send()allows sending tokens only to the same address as the sender's.
This can be bypassed by a smart contract.
Vulnerability Details
A user may deploy smart contract A on chain A and smart contract B on chain B with the same address, but different code.
Then, the code will allow teleporting tokens from A -> B. Now smart contract B, which has a totally different code than smart contract A, has access to the TempleGold tokens.
Impact
Bypassing of the bridging restriction.
Tools Used
Manual Review
Recommendations
Restrict the bridging to EOAs only.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.