Submitted by shaflow2
The receive_cross_chain_msg function does not check the execution status of cross-chain messages itself and relies entirely on the checks performed by the settlement contract. If the settlement contract is updated without changes to the validators, this could lead to a risk of previously executed transactions being replayed.
The settlement_address contract can be updated by the owner.
If the settlement_address contract is updated without changes to the validators, the cross-chain messages that were executed in the original settlement contract will no longer exist in the new settlement contract.
This allows an attacker to replay previously executed transactions from the old settlement contract, potentially leading to financial discrepancies or chaos because the receive_cross_chain_msg function does not check the execution status of cross-chain messages itself.
zvlwwj (Chakra) confirmed
0xsomeone (judge) commented:
0xsomeone (judge) commented:
