Maia DAO - Ulysses - DevABDee's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/interfaces/ILayerZeroUserApplicationConfig.sol#L24

Vulnerability details

The protocol doesn't implement a very important LayerZero function.

It is highly recommended by LayerZero to implement ILayerZeroUserApplicationConfig.forceResumeReceive(), because;

Implementing this interface will provide you with forceResumeReceive which in the worse case can allow the owner/multisig to unblock the queue of messages if something unexpected happens. -LayerZero Docs.

Impact

Better handling of queue msgs in worse case scenarios.

Proof-of-Concept

https://layerzero.gitbook.io/docs/evm-guides/best-practice

Tools Used

Manual Review

Recommended Mitigation Steps

Consider implementing ILayerZeroUserApplicationConfig.forceResumeReceive().

Assessed type

Other

1. Instead of doing same calculation again and again inside a function, consider saving it into a memory variable and then use it

_amount - _deposit is used at many places in the codebase and everywhere it is calculated. Like in the following code. Same calculation will cost more gas, better to cache it into a variable first and then use it multiple times.

        if (_amount - _deposit > 0) {
            unchecked {
                ///@audit-issue G Multiple same calculation will cost more gas, better to cache it into a variable first 
                _hToken.safeTransferFrom(msg.sender, address(this), _amount - _deposit);
                ERC20(_hToken).approve(_localPortAddress, _amount - _deposit);
            }
        }

Optimize the code like this:

        uint256 calc = _amount - _deposit;

        // Check if the local branch tokens are being spent
        if (calc > 0) {
            unchecked {
                ///@audit-issue G Multiple same calculation will cost more gas, better to cache it into a variable first 
                _hToken.safeTransferFrom(msg.sender, address(this), calc);
                ERC20(_hToken).approve(_localPortAddress, calc);
            }
        }

There are more than 10 instances where this optimization needs to be implemented.