search

code-423n4 / 2021-08-gravitybridge-findings

1 stars 0 forks source link

Consider adding a token whitelist in `sendToCosmos` function #54

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

hrkrshnn

Vulnerability details

Consider adding a token whitelist in sendToCosmos function

The function sendToCosmos does not have a whitelist of supported tokens. This means that it allows transferring arbitrary tokens (which does not have a cosmos equivalent) to the gravity bridge contract.

jkilpatr commented 2 years ago

This is the intended purpose of Gravity bridge, a cosmos representation is issued in the event handler , not a bug.

loudoguno commented 2 years ago

reopening as per judges assessment as "primary issue" on findings sheet