Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fund

Lines of code Vulnerability details Impact Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fun Proof of Concept One of the cross-chain request pass is that when user calling callOutSignedAndBridge via BranchBridgeAgent the payload is created //Encode Data for...

Lack of force resume support for LZ which is crucially important to have

Lines of code Vulnerability details Impact The User Application LZReceiver should implement the ILayerZeroUserApplicationConfig interface which includes the forceResumeReceive function. This is very important as in the worst case, it can allow the owner to unblock the queue of messages if somethi...

BranchBridgeAgent.retrieveDeposit doesn't check if the deposit is in FAILED state

Lines of code Vulnerability details Impact The BranchBridgeAgent.retrieveDeposit function is supposed to be called for retrieving a failed deposit in order to get funds back to branch chain, but the function doesn't check that the deposit being used is really in FAILED state, so a malicious user...