Udsen - THE `msg.sender` OF THE `AvailBridge.sendMessage` TRANSACTION WILL LOSE THE EXCESSIVE NATIVE ETH FUNDS TRANSFERRED TO THE TRANSACTION SINCE THIER IS NOT LOGIC TO REFUND THE EXCESSIVE AMOUNT

[sherlock-admin2]

Udsen

medium

THE msg.sender OF THE AvailBridge.sendMessage TRANSACTION WILL LOSE THE EXCESSIVE NATIVE ETH FUNDS TRANSFERRED TO THE TRANSACTION SINCE THIER IS NOT LOGIC TO REFUND THE EXCESSIVE AMOUNT

Summary

The AvailBridge.sendMessage function does not refund the excessive native eth (to the msg.sender) transferred to the contract after accounting for the respective fee amount.

Vulnerability Detail

The AvailBridge.sendMessage function is used for passing arbitrary data from Ethereum to Avail. The sendMessage is payable function and expected to recieve native eth which greater than the fee amount calculated based on the given message length which is to be passed to Avail chain.

There is an input validation check to ensure the msg.value >= fee amount as shown below:

        if (msg.value < getFee(length)) { //@audit-info - check msg.value against the minimum fee for a given message length
            revert FeeTooLow();
        }

But the issue here is that, if more native eth is transferred as fee to this sendMessage transaction that excessive eth will also be added to the fee state variable without being refunded to the msg.sender

Impact

This is loss of funds to the msg.sender if he mistakenly sends in a very large native eth amount (way more than the required fee amount) while calling the sendMessage transaction.

Code Snippet

        if (msg.value < getFee(length)) {
            revert FeeTooLow();
        }

https://github.com/sherlock-audit/2023-12-avail/blob/main/contracts/src/AvailBridge.sol#L306-L308

        fees += msg.value;

https://github.com/sherlock-audit/2023-12-avail/blob/main/contracts/src/AvailBridge.sol#L313

Tool used

VSCode and Manual Review

Recommendation

Hence it is recommended to add a logic to the AvailBridge.sendMessage function to refund the excessive native eth transferred to the sendMessage transaction, to the msg.sender after accounting for the calculated fee amount based on the message length to be passed to the Avail chain.

[sherlock-admin]

2 comment(s) were left on this issue during the judging contest.

tsvetanovv commented:

Invalid. User mistake. See Sherlock documentation

takarez commented:

valid because { and a duplicate of issue 013}