PoolTogether contest - joestakey's results

Judge has assessed an item in Issue #187 as M risk. The relevant finding follows:

[L‑02] EthereumToArbitrumRelayer.processCalls() does not check msg.sender is a contract The Arbitrum relay processCalls is intended to be called by EOA, as specified in the docs:

Arbitrum requires an EOA to submit a bridge transaction. But the function does not actually perform any check to ensure msg.sender is an EOA.

This should be enforced not only because of what is specified in the docs, but also because a contract calling EthereumToArbitrumRelayer.processCalls() can lead to the gas refund being lost:

The excessFeeRefundAddress parameter of Arbitrum's Inbox.createRetryableTicket() gets credited with the gas refund - if there is any.

In the EthereumToArbitrumRelayer.processCalls() implementation, that parameter is set to be msg.sender.

The issue is that if the caller is a contract, the refund will then be transferred to the L2 alias of the msg.sender, which:

may not exist on Arbitrum may not have any withdrawal function In such case, the refund fee is lost.

Lines of code https://github.com/pooltogether/ERC5164/blob/5647bd84f2a6d1a37f41394874d567e45a97bf48/src/ethereum-arbitrum/EthereumToArbitrumRelayer.sol#L122

Mitigation Add a msg.sender == tx.origin check in processCalls to ensure only EOAs can call the function.