Gas refunds are returned to the wrong address, leading to loss of funds for the payer

Lines of code Vulnerability details Impact To pay for cross-chain messages/calls, a user/third-party service must pay a reasonable fee in this case using the native token. However, often times a user will overpay to ensure that there is an adequate buffer for their tx to successfully succeed in...

Funds may be lost if processCalls is called from a contract

Lines of code Vulnerability details Impact In CrossChainRelayerArbitrum.processCalls, msg.sender is set as the address to receive any refund both excess fee refund and call value refund in the createRetryableTicket call. Arbitrium credits the refunded value to L2 balance, so if the user doesn't...

Refund Address can forcefully receive WETH

Lines of code Vulnerability details Impact In AxelarDepositService.sol , the refundAddress could forcefully receive WETH instead of the refundToken when calling any of the 3 functions refundTokenDeposit , refundNativeDeposit and refundNativeUnwrap. This is possible by due to // Allowing only the...