PoolTogether contest - Chom's results

Lines of code

https://github.com/pooltogether/ERC5164/blob/5647bd84f2a6d1a37f41394874d567e45a97bf48/src/ethereum-arbitrum/EthereumToArbitrumRelayer.sol#L101-L132

Vulnerability details

Impact

If a contract calls CrossChainRelayerArbitrum.processCalls, the entire msg.value is never refunded on the destination chain. ETH refunded on the destination chain will be blackholed.

Proof of Concept

createRetryableTicket(address destAddr, uint256 l2CallValue, uint256 maxSubmissionCost, address excessFeeRefundAddress, address callValueRefundAddress, uint256 maxGas, uint256 gasPriceBid, bytes data) → uint256

    uint256 _ticketID = inbox.createRetryableTicket{ value: msg.value }(
      address(executor),
      0,
      _maxSubmissionCost,
      msg.sender,
      msg.sender,
      _gasLimit,
      _gasPriceBid,
      _data
    );

CrossChainRelayerArbitrum.processCalls calls the standard Arbitrum Inbox's createRetryableTicket function with msg.value sent from the caller and msg.sender as the excessFeeRefundAddress and callValueRefundAddress. Assume this function is called by a contract at address 0xabcd on the ETH chain, but there isn't exists a contract at address 0xabcd on the Optimism chain. So, the refunded ETH will be blackholed (Nobody can redeem that ETH).

Recommended Mitigation Steps

Add a refundAddress parameter to the CrossChainRelayerArbitrum.processCalls function and pass it as the excessFeeRefundAddress and callValueRefundAddress on createRetryableTicket.

    uint256 _ticketID = inbox.createRetryableTicket{ value: msg.value }(
      address(executor),
      0,
      _maxSubmissionCost,
      refundAddress,
      refundAddress,
      _gasLimit,
      _gasPriceBid,
      _data
    );