Axelar Network v2 contest - cryptphi's results

Lines of code

https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L71 https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L124-L125

Vulnerability details

Impact

Whenever owner removes wrapping by calling removeWrapping() , it sets the wrapped[axelarToken] to 0. This would allow users to be able to call _executeWithToken() when the function is used in the future by calling a function that calls it (i.e if this function is really meant to be internal instead of external, but if it is really external function then can be called anytime)

The call in _executeWithToken() sets variable xc20 to wrapped[tokenAddress] which exists as address(0) after removeWrapping() call by owner. xc20 will pass the if-statement and then proceed to transfer tokens to receiver.

Tools Used

Manual review

Recommended Mitigation Steps

The mapping for the removed wrapping should be deleted instead of set to address 0.

1. No receive() function to receive ether in contract The following contracts have payable functions for caller to send ether to contract. However the contract does not implement receive() to receive the eth.

**Occurrences in: https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol

2. unchecked transfer There occurrences of IERC20(token).transfer() calls without returned value checks. Transactions will not be reverted on failed transfer, setting system state as if it was successful.

**Occurrences in: https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L23 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L51 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L128 would affect AxelarDepositService.refundNativeUnwrap() - > ReceiverImplementation.receiveAndUnwrapNative() - > recipient.transfer(receiver) AxelarDepositService.nativeUnwrap - > ReceiverImplementation.receiveAndUnwrapNative() - > recipient.transfer(receiver)

3. missing zero address check on recipient in : Some functions are missing zero address checks on receiver of funds

**Occurrences in: AxelarDepositService.refundNativeUnwrap() - > ReceiverImplementation.receiveAndUnwrapNative() - > recipient.transfer(receiver)

AxelarDepositService.nativeUnwrap - > ReceiverImplementation.receiveAndUnwrapNative() - > recipient.transfer(receiver)

AxelarDepositService.sendNative() - destinationAddress parameter

refundAddress param in the following functions: AxelarDepositService.refundTokenDeposit() AxelarDepositService.sendNativeDeposit() AxelarDepositService.refundNativeDeposit() AxelarDepositService.nativeUnwrap() AxelarDepositService.