Fees not integrated with LayerZero functions

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L180-L336
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgent.sol#L160-L344

Vulnerability details

Impact

LayerZero requires a fee to be paid to process transactions successfully.
If a user doesn't include enough eth for the gas, the transaction will fail, that's why an estimatefee function is available on the layerZero Endpoint address.
However no check is done to prevent users from sending insufficient eth with transactions. This causes an issue as transactions will fail on the LayerZero layer since execution will run out of gas

Proof of Concept

       function callOutAndBridge(
        address payable _refundee,
        address _recipient,
        uint16 _dstChainId,
        bytes calldata _params,
        SettlementInput calldata _sParams,
        GasParams calldata _gParams,
        bool _hasFallbackToggled
    ) external payable override lock requiresRouter {
        // Create Settlement and Perform call
        bytes memory payload = _createSettlement(
            settlementNonce,
            _refundee,
            _recipient,
            _dstChainId,
            _params,
            _sParams.globalAddress,
            _sParams.amount,
            _sParams.deposit,
            _hasFallbackToggled
        );

        //Perform Call.
        _performCall(_dstChainId, _refundee, payload, _gParams);
    }

As we can see, estimatefee is not checked at all. It also is not checked in _performCall

Tools Used

Manual Review, LayerZero Docs

Recommended Mitigation Steps

Get the estimated native fees for a transaction of a particular payload using `estimateFees(), and check against the current msg.value`` to ensure that it is enough.

Assessed type

Error

[c4-pre-sort]

0xA5DF marked the issue as duplicate of #785

[c4-pre-sort]

0xA5DF marked the issue as low quality report

[0xA5DF]

Identified only part of the issue, partial credit imo

[c4-judge]

alcueca marked the issue as not a duplicate

[alcueca]

As presented, it only impacts the user calling the function, and the only loss is gas

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a