Submission Details
Severity:
Smart contracts may lose their tokens when bridging
Summary
TempleGold.send()allows sending tokens from one address to the same address, but on another chain.
Vulnerability Details
Since smart accounts are not guaranteed to have the same address on every chain, it's possible for a smart contract, for example smart wallet, to bridge their tokens and forever lose them because they don't own the address on the other chain.
Impact
Loss of funds
Tools Used
Manual Review
Recommendations
Restrict the bridging to EOAs only.
Updates
Lead Judging Commences
inallhonesty
about 1 year ago
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Account abstraction, Multisig, Any other contract based solution that doesn't share the same address across chains will lose it's TGLD in teleport.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.