Submitted by Tendency, also found by QiuhaoLi, peakbolt, and rvierdiiev
When a user calls the RootBridgeAgent::retrySettlement function, to retry a failed settlement call to a root chain branch bridge agent (ArbitrumBranchBridgeAgent contract), msg.value (sent in native token) is passed as parameter in the internal call to the _performRetrySettlementCall function.
In the _performRetrySettlementCall function, native gas tokens are sent to the local branch bridge agent (Arbitrum branch bridge agent contract):
Assuming the execution fails at a point in ArbitrumBranchBridgeAgent, where fallback is toggled to true, ArbitrumBranchBridgeAgent::_performFallbackCall function is called.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L747
The problem here is, on fallback, the _performFallbackCall function does not refund the excess/remaining native gas deposit to the user:
Its important to note that in other branch bridge agents, users do receive a refund of their excess native gas deposit from Layer Zero when a similar situation occurs.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L785-L795
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/ArbitrumBranchBridgeAgent.sol#L112-L118
Consider refunding users their native gas tokens when performing a fallback call due to a prior failed execution in ArbitrumBranchBridgeAgent:
ETH-Transfer
0xBugsy (Maia) confirmed
alcueca (judge) decreased severity to Medium and commented:
0xBugsy (Maia) commented:
