However, transfer forwards a fixed stipend of 2300 gas that may be insufficient for some smart contract recipients, and could potentially revert in the future if gas costs change. (See the Consensys Diligence article here).
Impact: Some refund recipients and receivers, especially custom contracts or smart contract wallets, may be unable to receive native token transfers, breaking composability of the Axelar protocol.
Suggestion: Use <address payable>.call to perform native token transfers. However, note that forwarding unlimited gas introduces a potential vector for re-entrancy.
Lines of code
https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/ReceiverImplementation.sol#L22-L23 https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/ReceiverImplementation.sol#L51-L52 https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/ReceiverImplementation.sol#L71-L72 https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/ReceiverImplementation.sol#L84-L86 https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L128-L129 https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L144-L145
Vulnerability details
The Axelar contracts use
<address payable>.transfer
to perform native token transfers:ReceiverImplementation#receiveAndSendToken
:ReceiverImplementation#receiveAndSendNative
:ReceiverImplementation#receiveAndUnwrapNative
L#71:ReceiverImplementation#receiveAndUnwrapNative
L#84:AxelarGasService#collectFees
:AxelarGasService#refund
:However,
transfer
forwards a fixed stipend of 2300 gas that may be insufficient for some smart contract recipients, and could potentially revert in the future if gas costs change. (See the Consensys Diligence article here).Impact: Some refund recipients and receivers, especially custom contracts or smart contract wallets, may be unable to receive native token transfers, breaking composability of the Axelar protocol.
Suggestion: Use
<address payable>.call
to perform native token transfers. However, note that forwarding unlimited gas introduces a potential vector for re-entrancy.