1 Missing indexed field refundAddress

Each event should use three indexed fields if there are three or more fields. add indexed in refundAddress.

2 Missing contract check before low level call

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L222-L231

Low-level calls return success if there is no code present at the specified address. In addition to the zero-address checks, add a check to verify that

.code.length > 0

3 Missing check for address when assign values to state variable of address

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L26

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L18

add simple check for address to ensure address not 0.

4 Missing check TokenAddress cant be zero

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L65

to transfer some token the receiver address must be exist. add simple check for receiver address to ensure address not 0.

5 Multiple mappings can be combined into a single mapping an address to struct

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L20-L21

make the address mapping to a struct

6 use recently pragma solidity

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L3

Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(,)

code-423n4 / 2022-07-axelar-findings

QA Report #205

1 Missing indexed field refundAddress

2 Missing contract check before low level call

3 Missing check for address when assign values to state variable of address

4 Missing check TokenAddress cant be zero

5 Multiple mappings can be combined into a single mapping an address to struct

6 use recently pragma solidity

https://github.com/code-423n4/2022-07-axelar-findings/issues/1 Missing indexed field refundAddress

Missing contract check before low level call

Missing check for address when assign values to state variable of address & Missing check TokenAddress cant be zero

Multiple mappings can be combined into a single mapping an address to struct

use recently pragma solidity