Project

Summary

duplicate of https://github.com/code-423n4/2022-04-axelar-findings/issues/11

Vulnerability Details

As written in the solidity documentation, the low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed.

Impact

unexpect behaviour as the function returns true even if the contract does not exists and the msg.value will be lost

Tools Used

manual review

Recommendations

Check before any low-level call that the address actually exists, for example before the low level call in the callERC20 function you can check that the address is a contract by checking its code size.