<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `LzApp` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- set configuration of the LayerZero endpoint
- set the send version of the LayerZero endpoint
- set the receive version of the LayerZero endpoint
- resume the message flow in blocking mode and clear the stored payload
- set the trusted path for the cross-chain communication
- set the trusted remote address
- set precrime
- set the minimum gas parameter for a packet type on a given chain
- set payload size limit
  
![](https://accelerator-tasks-prod.s3.amazonaws.com/fa9e1ce7554b467fa8b1df69bb540905/diagrams/centralization_WrappedTokenBridge-LzApp-_owner.svg)

In the contract `TokenBridgeBase` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and 
- set the `useCustomAdapterParams` flag indicating whether the contract uses custom adapter parameters or the default ones
  
![](https://accelerator-tasks-prod.s3.amazonaws.com/fa9e1ce7554b467fa8b1df69bb540905/diagrams/centralization_WrappedTokenBridge-TokenBridgeBase-_owner.svg)

In the contract `WrappedTokenBridge` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- register a token supported in this bridge
- set withdrawal fee bps

![](https://accelerator-tasks-prod.s3.amazonaws.com/fa9e1ce7554b467fa8b1df69bb540905/diagrams/centralization_WrappedTokenBridge-WrappedTokenBridge-_owner.svg)


In the contract `OriginalTokenBridge` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- register a token supported in this bridge and set the decimals
- set remote chain id
- withdraw fee from the contract
  
![](https://accelerator-tasks-prod.s3.amazonaws.com/8e9847ba11674ee3a20bc33a5765245e/diagrams/centralization_OriginalTokenBridge-OriginalTokenBridge-_owner.svg)


**Improper configuration of the above bridge parameters could compromise the functionality of the bridge, obstruct message transmission, or even result in the lockout or theft of users' funds.** 

**More details can be found in finding OTB-02 and OTB-04, **

Potential Rug Pull Risks Introduced by Centralized Bridge Control

The current implementation displays an issue regarding the `setWithdrawalFeeBps()` function. There is no established upper limit restricting the parameter of this function, potentially enabling up to 100% of fees on bridge transactions. 

In this case, the contract owner will receive 100% of the bridged amount as fees while the user will lose all of their bridged assets.

This lack of constraint could lead to an undue burden on users and possibly deter the utilization of the bridge.

No Upper Limits for Fees

In the current implementation, there is no input validation for the `setPayloadSizeLimit()` function's `_size` argument. Consequently, if an inappropriately small value, such as 1, is set, it could render the bridge unusable as all user payloads would exceed this limit.

```solidity=
    function setPayloadSizeLimit(uint16 _dstChainId, uint _size) external onlyOwner {
        payloadSizeLimitLookup[_dstChainId] = _size;
    }
```
```solidity=
    function _checkPayloadSize(uint16 _dstChainId, uint _payloadSize) internal view virtual {
        uint payloadSizeLimit = payloadSizeLimitLookup[_dstChainId];
        if (payloadSizeLimit == 0) { // use default if not set
            payloadSizeLimit = DEFAULT_PAYLOAD_SIZE_LIMIT;
        }
        require(_payloadSize <= payloadSizeLimit, "LzApp: payload size is too large");
    }
      
```

Missing validation of `PayloadSizeLimit`

In the Current implementation, functions `setTrustedRemote` and `setTrustedRemoteAddress` will not check if the input argument `_path` and `_remoteAddress` is valid or not. 

```solidity=
    function setTrustedRemote(uint16 _srcChainId, bytes calldata _path) external onlyOwner {
        trustedRemoteLookup[_srcChainId] = _path;
        emit SetTrustedRemote(_srcChainId, _path);
    }

    function setTrustedRemoteAddress(uint16 _remoteChainId, bytes calldata _remoteAddress) external onlyOwner {
        trustedRemoteLookup[_remoteChainId] = abi.encodePacked(_remoteAddress, address(this));
        emit SetTrustedRemoteAddress(_remoteChainId, _remoteAddress);
    }

```
It's important to note that the `TokenBridge` contract trusts the message and payload from the `TrustedRemote`. Any improper configuration of the trustedRemoteLookup can disrupt cross-chain communication among bridge contracts. This disruption could potentially result in tokens becoming permanently locked, posing a significant risk to the overall operation of the system.

Furthermore, the implications could be more severe if a malicious contract is designated as the `trustedRemote`. In this scenario, the malicious contract could generate an arbitrary payload and drain the tokens within the original token bridge, posing a severe threat to the security and integrity of the system.

Missing validation of `TrustedRemote`

The bridge owner can add arbitrary ERC-20 tokens for bridging through the function `registerToken()`. If the wrapped token is compromised (such as unlimited mint) on the destination chain, it can be used to drain the original token on the source chain. 

```solidity=
    function registerToken(address token, uint8 sharedDecimals) external onlyOwner {
        require(token != address(0), "OriginalTokenBridge: invalid token address");
        require(!supportedTokens[token], "OriginalTokenBridge: token already registered");

        uint8 localDecimals = _getTokenDecimals(token);
        require(localDecimals >= sharedDecimals, "OriginalTokenBridge: shared decimals must be less than or equal to local decimals");

        supportedTokens[token] = true;
        LDtoSDConversionRate[token] = 10**(localDecimals - sharedDecimals);
        emit RegisterToken(token);
    }
```

Besides, any misconfiguration of token and its decimals will lead to incorrect briding amounts, thereby posing a risk of fund loss to the users.

Risk of supporting arbitrary ERC-20 tokens

Function `setRemoteChainId()` does not check if the input chain Id is valid and supported by the LayerZero Endpoint. An improper setting of the `remoteChainId` can lead to tokens, once bridged out, being irretrievably locked in the bridge contract.

```solidity=1717
    function setRemoteChainId(uint16 _remoteChainId) external onlyOwner {
        remoteChainId = _remoteChainId;
        emit SetRemoteChainId(_remoteChainId);
    }
```

Missing validation of `remoteChainId`

The only requirement for the `_minGas` is that it is greater than 0. An insufficient min gas configuration could cause cross chain transactions to fail. Custom adapter parameters and minimum destination gas for each cross-chain path can be used when the default amount of gas (200,000) is not enough. This requires whoever calls the send function to provide the adapter params with a destination gas >= amount set in the minDstGasLookup for that chain. 

```solidity=
    function setMinDstGas(uint16 _dstChainId, uint16 _packetType, uint _minGas) external onlyOwner {
        require(_minGas > 0, "LzApp: invalid minGas");
        minDstGasLookup[_dstChainId][_packetType] = _minGas;
        emit SetMinDstGas(_dstChainId, _packetType, _minGas);
    }
```

```solidity=
    function _checkGasLimit(uint16 _dstChainId, uint16 _type, bytes memory _adapterParams, uint _extraGas) internal view virtual {
        uint providedGasLimit = _getGasLimit(_adapterParams);
        uint minGasLimit = minDstGasLookup[_dstChainId][_type] + _extraGas;
        require(minGasLimit > 0, "LzApp: minGasLimit not set");
        require(providedGasLimit >= minGasLimit, "LzApp: gas limit is too low");
    }
```

Settings of `minDstGas`

The contract is serving as the underlying entity to interact with one or more third-party libraries and protocols, such as `LayerZero` and ERC-20 tokens. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, etc. Additionally, if the wrapped token is compromised (such as unlimited mint) on the destination chain, it can be used to drain original token on the source chain. 

```solidity=1008
    ILayerZeroEndpoint public immutable lzEndpoint;
```
- The contract `LzApp` interacts with third party contract with `ILayerZeroEndpoint` interface via `lzEndpoint`.


---
```solidity=1418
    mapping(address => mapping(uint16 => address)) public remoteToLocal;
```
- The contract `WrappedTokenBridge` interacts with third party contract with `IWrappedERC20` interface via `remoteToLocal`.


---
```solidity=1455
    function bridge(address localToken, uint16 remoteChainId, uint amount, address to, bool unwrapWeth, LzLib.CallParams calldata callParams, bytes memory adapterParams) external payable nonReentrant {
```
- The function `WrappedTokenBridge.bridge` interacts with third party contract with `IWrappedERC20` interface via `localToken`.

```solidity=1338
    ILayerZeroEndpoint public immutable lzEndpoint;
```
- The contract `LzApp` interacts with third party contract with `ILayerZeroEndpoint` interface via `lzEndpoint`.


---
```solidity=1687
    address public immutable weth;
```
- The contract `OriginalTokenBridge` interacts with third party contract with `IWETH` interface via `weth`.


---
```solidity=1722
    function accruedFeeLD(address token) public view returns (uint) {
```
- The function `OriginalTokenBridge.accruedFeeLD` interacts with third party contract with `IERC20` interface via `token`.


---
```solidity=1734
    function bridge(address token, uint amountLD, address to, LzLib.CallParams calldata callParams, bytes memory adapterParams) external payable nonReentrant {
```
- The function `OriginalTokenBridge.bridge` interacts with third party contract with `IERC20` interface via `token`.


---
```solidity=1787
        (uint8 packetType, address token, address to, uint withdrawalAmountSD, uint totalAmountSD, bool unwrapWeth) = abi.decode(payload, (uint8, address, address, uint, uint, bool));
```
- The function `OriginalTokenBridge._nonblockingLzReceive` interacts with third party contract with `IERC20` interface via `token`.



Third Party Dependency

Ignore Fud Bridge

WrappedTokenBridge.sol

OriginalTokenBridge.sol

transfer

transferFrom

totalSupply

balanceOf

allowance

approve

DividendPayingToken

FourTestDividendTracker

FourTest

Initial Token Distribution

Function Call Not Revert on Failure

Reward Token Address May Change

Potential Sandwich Attacks

Unused Return Value

Unoptimized One-Sided Supply

Gas Fee Passed to User

Locked Native token

Unsafe Integer Cast

Dividends Not Updated

State Variable Should Be Declared Constant

Ineffective Assignment

Updating Inconsistencies

Undisclosed Fee

Missing Emit Events

Missing Error Messages

Solidity Version Not Recommended

Ignore Fud - audit

DividendPayingToken.sol

DividendTracker.sol

Four.sol

CertiK KYC

CertiK Skynet

Top 10% Watchlisted

Top 10% Security Score

Top 10% Operation Score

Top 10% Fundamental Score

A new kind of meme token that supports DeFi and Blockchain innovations. Ignore Fud Project was created to help Coredao, Binance and the cryptocurrency industry as a whole and get more people to use and adopt cryptocurrencies. We provide a community-centric meme ecosystem, a unique hold to earn with exposure to a large and strong community of users from all over the world.

Leaderboards

Due Diligence Tools

Resources

Bug Bounty Program