search

sherlock-audit / 2024-09-orderly-network-solana-contract-judging

0 stars 0 forks source link

Rural Frost Skunk - SolCOnnector.sol address passed to lzSend() will cause fees refunded to be stucked #169

Open sherlock-admin2 opened 4 days ago

sherlock-admin2 commented 4 days ago

Rural Frost Skunk

Medium

SolCOnnector.sol address passed to lzSend() will cause fees refunded to be stucked

Summary

SolCOnnector.sol address passed to lzSend() will cause fees refunded to be stucked

Root Cause

lzsend() passes address.this as refund address in case the send call reverts, however, in this case the address.this would be the SolCOnnector contract but no way to withdraw in this contract causing fees refunded to be stucked.

Internal pre-conditions

None

External pre-conditions

Fees refunded

Attack Path

n/a

Impact

will cause fees refunded to be stucked

PoC

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/sol-cc/contracts/SolConnector.sol#L97

bytes memory payload = MsgCodec.encodeWithdrawPayload(withdrawData);
        bytes memory lzWithdrawMsg = MsgCodec.encodeLzMsg(uint8(MsgCodec.MsgType.Withdraw), payload);
        bytes memory withdrawOptions = OptionsBuilder.newOptions().addExecutorLzReceiveOption(
            msgOptions[uint8(MsgCodec.MsgType.Withdraw)].gas,
            msgOptions[uint8(MsgCodec.MsgType.Withdraw)].value
        );
        MessagingFee memory _msgFee = _quote(solEid, lzWithdrawMsg, withdrawOptions, false);
        _lzSend(solEid, lzWithdrawMsg, withdrawOptions, _msgFee, address(this)); <@

Mitigation

Recommendation: Consider passing in an admin address that handles this instead of address.this or implement a way for withdrawal in the contract