Open code423n4 opened 2 years ago
Valid R
L
NC
Don't think you need this, NC
Valid L
Disagree, your colleagues would be sending "floating pragma" reports.
Disputing in lack of detail, please add more information next time (what would the fixed system look like?)
Also not convinced by this as the codebase doesn't seem to use it
Overall a genuine report, thank you!
2L 1R 2NC
Transferring dust native fund is not related to addWrapping
https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L63
Why transfer dust fund using addWrapper? Consider adding a separate function to do this.
Use payable(...).call{value: ...}("") instead of .transfer
Using deprecated
transfer()
on address payable may revert in these cases:Additionally, using higher than 2300 gas might be mandatory for some multisig wallets.
An example on Axelar codebase that using .transfer is in https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L144
Should be
XC20Wrapper is not emitting any event
XC20Wrapper should emit events on wrap / unwrap / receive cross chain fund (_executeWithToken) to allow indexers to track the transactions.
_isSortedAscAndContainsNoDuplicate failed if accounts.length == 0
https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L115-L123
It is using
accounts.length - 1
which will be underflow and revert when accounts.length == 0Consider adding if to skip this case
Missing minimum newThreshold check
https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L72
New threshold shouldn't be too low such that just one low weight operator can execute malicious transaction.
It would be great to have some more shield on this important function by checking new threshold to be more than xx% of totalWeight
Should use
pragma solidity ^0.8.9;
instead ofpragma solidity 0.8.9;
pragma solidity ^0.8.9;
allow application that import this library to use more recent version of solidity 0.8.x such as 0.8.13 to compile the contracts whilepragma solidity 0.8.9;
doesn't allow it.If that application use some library that require ^0.8.13. That application may not be able to used with Axelar.
AxelarDepositService is not support general message passing
We cannot see anything related to contract calling such as target contract address or payload in the https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol.
Which means it doesn't support general message passing
XC20 token doesn't support general message passing on auto xc20 wrap
payload only hold receiver which is not sufficient for general message passing (require target contract and payload). Moreover, there aren't any logic involve contract calling on _executeWithToken.