Submitted by berndartmueller, also found by ChristiansWhoHack
Certain inbound transactions can not be added to the inbound transaction tracker due to the inability to verify their legitimacy, potentially resulting in missed inbound transactions.
Anyone can submit inbound transactions to ZetaChains InTxTracker via the MsgAddToInTxTracker message in case the transaction was missed by the observers in the first place, to ensure the transaction is processed.
The AddToInTxTracker function handles the MsgAddToInTxTracker message and ensures that the submitted transaction is a valid inbound transaction by verifying the provided block inclusion proof in line 28.
After verifying if the transaction is included in the block, the transaction is checked if it is a valid inbound transaction by calling the VerifyEVMInTxBody function in line 34.
The VerifyEVMInTxBody function checks in lines 75 and 84 if the transactions To address is the expected address for the given coin type. For example, if the coin type is common.CoinType_ERC20, the To address must match the address of the ERC20Custody contract. Otherwise, if the To address is not the expected address, the transaction is considered invalid and not added to the inbound transaction tracker.
However, this check is not sufficient to reliably determine if the transaction is a valid inbound tx.
Specifically, if the ERC20Custody.deposit function was called from another contract, thus the transactions To address is not the ERC20Custody contract address, the transaction can not be added to the tracker, even though it is a valid inbound transaction. Potentially resulting in a missed inbound transaction.
Similarly, the common.CoinType_Zeta coin type is also affected.
For completeness, Id like to point out that for the common.CoinType_Gas coin type, if a contract sends native gas tokens to the TSS address, it is not possible to determine if the transaction is a valid inbound transaction.
Consider also allowing to provide the logged event (log) and the accompanying proof of the event inclusion by verifying the receipt merkle trie proof.
lumtis (ZetaChain) acknowledged
