Submitted by 0xb0k0, also found by AllTooWell, rbserver, said, shaflow2, fyamf, Abdessamed, SBSecurity, calfun0x, joicygiore, ABAIKUNANBAEV, Coinymous, Audinarey, b0g0, gajiknownnothing, mojito_auditor, devival, and jasonxiale
https://github.com/code-423n4/2024-08-chakra/blob/d0d45ae1d26ca1b87034e67180fac07ce9642fd9/solidity/handler/contracts/ChakraSettlementHandler.sol#L160
https://github.com/code-423n4/2024-08-chakra/blob/d0d45ae1d26ca1b87034e67180fac07ce9642fd9/solidity/handler/contracts/ChakraSettlementHandler.sol#L218
The ChakraSettlementHandler incorrectly passes the contract address instead of the token one, when creating the create_cross_txs transaction and when emitting the CrossChainLocked event. The contract depends heavily on correct event emission as the protocols validators listen for these events and execute state-changing operations based on them.
The ChakraSettlementHandler::cross_chain_erc20_settlement(...) function processes incoming cross-chain settlement user requests and sends data to the settlement contract. The method creates CreatedCrossChainTx along the way:
However, in the current implementation, instead of sending the from_token address it sends the actual contract address:
When the transaction is sent to the settlement contract a CrossChainLocked is emitted:
However, the method, once more sends the incorrect from_token address:
If we peek into the Cairo implementation we can see that the from_token address should indeed be the token address not the handler contract address:
Use the correct from_token address in  ChakraSettlementHandler::cross_chain_erc20_settlement(...).
pidb (Chakra) confirmed via duplicate issue #175
0xsomeone (judge) increased severity to High and commented:
