Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Anirruth - Gas could get stuck in the contract #159

Open
sherlock-admin2 opened this issue Oct 27, 2024 · 0 comments
Open

Anirruth - Gas could get stuck in the contract #159

sherlock-admin2 opened this issue Oct 27, 2024 · 0 comments
Labels
Sponsor Disputed The sponsor disputed this issue's validity

Comments

@sherlock-admin2
Copy link
Contributor

sherlock-admin2 commented Oct 27, 2024

Anirruth

Medium

Gas could get stuck in the contract

Summary

User could lose the extra gas fee they sent due to incorrect return value in _payNative function.

Root Cause

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/sol-cc/contracts/layerzerolabs/lz-evm-oapp-v2/contracts/oapp/OAppSenderUpgradeable.sol#L110-L114
The _payNative function has the following check :

function _payNative(uint256 _nativeFee) internal virtual returns (uint256 nativeFee) {
    // enable the OApp to pay the native fee
    if (msg.value < _nativeFee && address(this).balance < _nativeFee) revert NotEnoughNative(msg.value);
    return _nativeFee; //@audit should return msg.value so that the extra gas gets refunded to the user
}

As the function has && not || the user will provide the required gas fee, so the extra fee (_nativeFee - msg.value) paid by the user will get stuck in the contract.

Internal pre-conditions

None

External pre-conditions

None

Impact

User loses the entitled refund of gas fee.

Mitigation

Refund the extra fee (_nativeFee - msg.value) paid by the user.

@sherlock-admin3 sherlock-admin3 added the Sponsor Disputed The sponsor disputed this issue's validity label Nov 3, 2024
@sherlock-admin4 sherlock-admin4 changed the title Bouncy Butter Cat - Gas could get stuck in the contract Anirruth - Gas could get stuck in the contract Nov 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Sponsor Disputed The sponsor disputed this issue's validity
Projects
None yet
Development

No branches or pull requests

2 participants