Submitted by Shield, also found by Shield
When a bridged token is received on the dest chain, ERC20Vault.onMessageInvocation() is being called.
onMessageInvocation() always calls to.sendEther(msg.value) even when the msg.value is zero.
sendEther() would attempt to call the contract with the value supplied and empty data. If the to address ia a contract that doesnt implement neither the fallback function nor receive then the entire transaction would revert.
The same issue occurs during recalling the message, if the sender is also a contract that doesnt implement neither a fallback nor receive then the recalling would fail as well.
Funds would be lost, since the sending cant be finalized and recovering would revert as well.
While this might be considered a user error when sending a value thats greater than zero (they shouldve checked that the to address implements the receiver), this cant be said about the case where the value is zero - the user wont expect the vault to call the to contract with zero value.
Add the following PoC to test\tokenvault\ERC20Vault.t.sol:
dantaik (Taiko) confirmed and commented:
