Funds stuck in router if no additional payload send during callOutAndBridge

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgentExecutor.sol#L100-L105

Vulnerability details

Impact

The callOutAndBridge flow causes funds to be locked if no additional payload is send.

Proof of Concept

In RootBridgeAgentExecutor.executeWithDeposit the function ends if the payload is not longer than 128 bytes:

//router is recipient of funds
_bridgeIn(_router, dParams, _srcChainId);

if (_payload.length > PARAMS_TKN_SET_SIZE) {
    //Execute remote request
    IRouter(_router).executeDepositSingle{value: msg.value}(
        _payload[PARAMS_TKN_SET_SIZE:], dParams, _srcChainId
    );
}
//END

At this point however, the funds that were bridged in were send to the router, where they remain.

Tools Used

Manual review

Recommended Mitigation Steps

Revert, if the router is not called (payload.length <= PARAMS_TKN_SET_SIZE)

Assessed type

Other

[c4-pre-sort]

0xA5DF marked the issue as primary issue

[c4-pre-sort]

0xA5DF marked the issue as sufficient quality report

[0xBugsy]

This is a duplicate of #685

[c4-judge]

alcueca marked the issue as duplicate of #685

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a