Submitted by windhustler
Pathway for sendForLeverage -> leverageDown always fails if the TapiocaOFT or mTapiocaOFT holds the native token as underlying, i.e. erc20 == address(0).
This results in loss of gas, airdropped amount, and burned TOFT on the sending side for the user.
The failed message if retried will always fail and result in permanent loss for the user.
TapiocaOFT/mTapiocaOFT is deployed with erc20 being address(0) in case if it holds the native token as an underlying token.
However, it still allows anyone to execute the sendForLeverage which always results in reverts when receiving the message.
The revert happens at IERC20(erc20).approve(externalData.swapper, amount); since address(0) doesnt have an approve function.
The message if retried will just keep on reverting because of the same reason due to the way the failedMessages are stored, e.g. you can just retry the same exact payload.
This way anyone invoking this function will lose his TOFT tokens forever.
Disable sendForLeverage function if the TapiocaOFT or mTapiocaOFT holds the native token as underlying, e.g. revert on the sending side.
0xRektora (Tapioca) confirmed
