Axelar Network v2 contest - tofunmi's results

Lines of code

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L63

Vulnerability details

Any smart contract that uses transfer() or send() is taking a hard dependency on gas costs by forwarding a fixed amount of gas: 2300. My recommendation is to stop using transfer() and send() in your code and switch to using call() instead:

Affected Line

• https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L63

Recommended Mitigation step

(bool success, ) = recipient.call{value:amt}("");
require(success, "Transfer failed.");

• You can control the amount of gas instead of using transfer
  • Keep in mind to check whether the call was successful by validating the return value

Gas

• use a more efficient loop, to save a significant amount of gas n your loops, by doing unchecked{++i;} at the end of the loop execution (even gas savings up to 1000 depending on the size)

• for example

function effiecientLoop(uint256[] arr) public{
	. . . . 
	for(uint256 i = 0; i < arr.length;) {
		. . . . . 
		unchecked{
		  ++i;
		}
          }
   }

Affected lines for unefficient loops

• /contracts/AdminMultisigBase.sol#L51
• /contracts/AdminMultisigBase.sol#L158
• /contracts/AxelarGateway.sol#L198
• /contracts/AxelarGateway.sol#L207
• /contracts/AxelarGateway.sol#L292
• /contracts/auth/AxelarAuthWeighted.sol#L17
• /contracts/auth/AxelarAuthWeighted.sol#L69
• /contracts/auth/AxelarAuthWeighted.sol#L98
• /contracts/auth/AxelarAuthWeighted.sol#L116
• /contracts/deposit-service/AxelarDepositService.sol#L114
• /contracts/deposit-service/AxelarDepositService.sol#L204
• /contracts/gas-service/AxelarGasService.sol#L123