Submitted by Audinarey, also found by AllTooWell, said, fyamf, SBSecurity, b0g0, Tigerfrake, mojito_auditor, Draiakoo, and jasonxiale
https://github.com/code-423n4/2024-08-chakra/blob/d0d45ae1d26ca1b87034e67180fac07ce9642fd9/cairo/handler/src/handler_erc20.cairo#L188
https://github.com/code-423n4/2024-08-chakra/blob/d0d45ae1d26ca1b87034e67180fac07ce9642fd9/cairo/handler/src/handler_erc20.cairo#L222
In the handler_erc20::cross_chain_erc20_settlement(...) function, the tx_id is saved with the CreatedCrossChainTx struct which contains info about the transaction including the sender whose account the token was transferred from.
However, on L188 the from value is supposed to be the callers address, but the handler_erc20 address is used instead of the get_caller_address().
Moreso, the event that are being used by the validators uses from: get_caller_address(),.
The problem is that
Modify the handler_erc20::cross_chain_erc20_settlement(...) function as shown below:
zvlwwj (Chakra) confirmed via duplicate issue #174
0xsomeone (judge) commented:
Abdessamed (warden) commented:
0xsomeone (judge) decreased severity to Medium and commented:
