Submitted by Chom, also found by csanuragjain
BridgeFacet.sol#L856-L877
Executor.sol#L142-L144
Executor.sol#L160-L166
Executor.sol#L194-L213
_handleExecuteTransaction may not working correctly on fee-on-transfer tokens. As duplicated fee is applied to fee on transfer token when executing a arbitrary call message passing request. Moreover, the Executor contract increase allowance on that token for that target contract in full amount without any fee, this may open a vulnerability to steal dust fund in the contract
Moreover, failure is trying to send full amount without any fee which is not possible because fee is already applied one time for example 100 Safemoon -> 90 Safemoon but trying to transfer 100 safemoon to _recovery address. Obviously not possible since we only have 90 Safemoon. This will revert and always revert causing loss of fund in all case of fee-on-transfer tokens.
A message to transfer 100 Safemoon with some contract call payload has been submitted by a relayer to _handleExecuteTransaction function on BridgeFacet these lines hit.
Noticed that 100 Safemoon is transferred to executor before contract execution. Now executor has 90 Safemoon due to 10% fee on transfer.
Next, we increase allowance of target contract to transfer 100 more Safemoon.
After that, it call target contract
Target contract tried to pull 100 Safemoon from Executor but now Executor only has 90 Safemoon, so contract call failed. Moving on to the failure handle.
isNative = false because of Safemoon
Trying to transfer 100 Safemoon to _recovery while only having 90 Safemoon in the contract. Thus failure handle is reverted.
You should approve one step only. Avoid an extra token transfer.
LayneHaber (Connext) confirmed and commented:
LayneHaber (Connext) acknowledged and commented:
LayneHaber (Connext) resolved:
0xleastwood (judge) decreased severity to Medium and commented:
