sherlock-audit / 2024-09-orderly-network-solana-contract-judging

0 stars 0 forks source link

Petite Pecan Starfish - admin cannot sweep left over assets in solconnector #81

Open sherlock-admin2 opened 4 days ago

sherlock-admin2 commented 4 days ago

Petite Pecan Starfish

High

admin cannot sweep left over assets in solconnector

Summary

admin cannot sweep left over assets in solconnector

Root Cause

solconnector contract should send native token or lztoken as fee to layerzero's endpoint but withdraw function isn't payable its mean msg.value always is zero and solconnector should has enough balance to pay fee and as I understood they should send ether directly to solconnector contract but problem is here there is no way to sweep remaining native tokens in solconnecor, hence left over native tokens stuck in solconnector contract

Code Snippet

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/sol-cc/contracts/SolConnector.sol#L77

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/sol-cc/contracts/layerzerolabs/lz-evm-oapp-v2/contracts/oapp/OAppSenderUpgradeable.sol#L112

Impact

stuck left over native tokens in solconnector

Mitigation

consider to add some functionality to sweep left over assets