Submitted by Jeiwan, also found by Shubham and Chom
The validateSender and addTrustedAddress functions of RemoteAddressValidator can incorrectly handle the passed address arguments, which will result in false negatives. E.g. a valid sender address may be invalidated.
The RemoteAddressValidator._lowerCase function is used to convert an address to lowercase. Since the protocol is expected to support different EVM and non-EVM chains, account addresses may have different format, thus the necessity to convert them to strings and to convert the strings to lowercase when comparing them. However, the function only converts the hexadecimal letters, i.e. the characters in ranges A-F:
Here, 65 corresponds to A, and 70 corresponds to F. But, since different EVM and non-EVM chains are supported, addresses can contain other characters. For example, Cosmos uses bech32 addresses and Evmos supports both hexadecimal and bech32 addresses.
If not all alphabetical characters of an address are converted to lowercase, then the address comparison in the validateSender can fail and result in a false revert.
In the _lowerCase function, consider converting all alphabetical characters to lowercase, e.g.:
deanamiel (Axelar) disagreed with severity and commented:
berndartmueller (judge) commented:
milapsheth (Axelar) commented:
