[Lines of code](https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/PoolManager.sol#L78) # Vulnerability details ## Impact The cross chain message passing is done through the axelar gateway contracts. To pass the message, the message has to be formatted (abi.encode) and sent to destination chain from source chain. In destination chain, through gateway contract, the received message is decoded and then respective functions are executed. The issue is, the method which is used to encode and decode the message is inconsistent with what is recommended in Axelar documentation. Due to this, the message can not be properly relayed which causes in the disruption in cross chain contract calls. ## Proof of Concept Lets take one example where cross chain communication is initiated and propagated till the execution on the destination chain. The call flow like this, PoolManager,, InvestmentManager -> Gateway(source chain) -> Messages-> Router -> Gateway( destination chain for execution) The call is coming from Gateway. () function handleExecutedCollectInvest( uint64 poolId, bytes16 trancheId, address recipient, uint128 currency, uint128 currencyPayout, uint128 trancheTokensPayout ) public onlyGateway { } else if (Messages.isExecutedCollectInvest(message)) { ( uint64 poolId, bytes16 trancheId, address investor, uint128 currency, uint128 currencyPayout, uint128 trancheTokensPayout ) = Messages.parseExecutedCollectInvest(message); investmentManager.handleExecutedCollectInvest( poolId, trancheId, investor, currency, currencyPayout, trancheTokensPayout ); when we look at the message encoding process. function collectInvest(uint64 poolId, bytes16 trancheId, address investor, uint128 currency) public onlyInvestmentManager pauseable { outgoingRouter.send(Messages.formatCollectInvest(poolId, trancheId, _addressToBytes32(investor), currency)); } function collectInvest(uint64 poolId, bytes16 trancheId, address investor, uint128 currency) public onlyInvestmentManager pauseable { outgoingRouter.send(Messages.formatCollectInvest(poolId, trancheId, _addressToBytes32(investor), currency)); } abi.encoding is used to construct the payload data. but, when we refer the Axelar documentation, payload should be encode with abi.encode. refer the document. ! Also, the Axelar recommends to standard abi.decode to decode the message on the destination chain. But, in the current implementation, customized decoding is done using the functions from BytesLib library. function _execute( string memory sourceChain, string memory sourceAddress, bytes calldata payload ) internal override { // decoding a string string memory _message = abi.decode(payload, (string)); } ## Tools Used Manual review. Axelar documentation. ## Recommended Mitigation Steps We suggest the recommended procedure from Axlear network for cross chain payload construction and de-construction. ## Assessed type en/de-code --- The text was updated successfully, but these errors were encountered: All reactions