As we can see here, maxSubmissionCost is extracted inside the function and it would be difficult to know the correct expectedEth before the function call.
So it's possible that a user might send more msg.value than he should and the exedent ETH will lost.
I believe this is invalid, and the exact amount is unknown at the time the value is transferred to the L2 - will leave open for sponsor to confirm understanding.
Lines of code
https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/gateway/L1GraphTokenGateway.sol#L224
Vulnerability details
Impact
Possible lost ETH in
L1GraphTokenGateway.outboundTransfer()
.Proof of Concept
L1GraphTokenGateway.outboundTransfer()
is apayable
function and it checks withmsg.value
like below.As we can see here,
maxSubmissionCost
is extracted inside the function and it would be difficult to know the correctexpectedEth
before the function call.So it's possible that a user might send more
msg.value
than he should and the exedent ETH will lost.Tools Used
Solidity Visual Developer of VSCode
Recommended Mitigation Steps
Recommend adding the ETH refund logic here.