Whenever there is a need to process interchain transfers the _transmitInterchainTransfer() gets called, now the amount of gas thats to be payed to process this transfer is also attached with this query; for example, see this instance in InterchainTokenService#interchainTransfer().
https://github.com/code-423n4/2024-08-axelar-network/blob/69c4f2c3fcefb1b8eb2129af9c3685a44ae5b6fe/interchain-token-service/contracts/InterchainTokenService.sol#L1148-L1185
As hinted earlier on, this function transmits the callContract prefixed functionalities for the given tokenId. Per the documentation, it can be deduced that whenever gasValue is attached, it should be at least msg.value and then the remainder would be refunded to the specified tx.origin.
However, the problem is that no where is this enforced; which then allows anyone to pass any value as their gasValue when querying, for example, InterchainTokenService#interchainTransfer() while actually attaching way less than that as their msg.value.
Borderline low/medium. Per information from the sponsors the contract is never expected to hold native funds in it, but this in short causes a leak of value, since users can get their interchain transfers processed for relatively free.
Consider explicitly checking in the outermost query that needs gasValue that indeed the msg.value provided is at least up to this value.
