requiresFallbackGas cannot guarantee adequate gas for anyFallback

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1061-L1072
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1410-L1412

Vulnerability details

Impact

requiresFallbackGas cannot guarantee adequate gas for anyFallback. If fallback execution _forceRevert(), the user can no longer redeemDeposit and their asset will be permanently lost.

Proof of Concept

function _payFallbackGas(uint32 _depositNonce, uint256 _initialGas) internal virtual {
    uint256 gasLeft = gasleft();
    uint256 minExecCost = tx.gasprice * (MIN_FALLBACK_RESERVE + _initialGas - gasLeft);

    if (minExecCost > getDeposit[_depositNonce].depositedGas) {
        _forceRevert();
        return;
    }
    ......
}

function _requiresFallbackGas() internal view virtual {
    if (msg.value <= MIN_FALLBACK_RESERVE * tx.gasprice) revert InsufficientGas();
}

There are two possibilities that deposited gas would be insufficient for fallback execution:

1. msg.value is only slightly larger than tx.gasprice * MIN_FALLBACK_RESERVE but smaller than tx.gasprice * (MIN_FALLBACK_RESERVE + _initialGas - gasLeft)
2. tx.gasprice rises during two transactions.

Tools Used

Manual review

Recommended Mitigation Steps

Charge and replenish fallback gas during the initial deposit call and never forceRevert() fallback execution (consequence is severe).

Assessed type

Context

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-judge]

trust1995 marked the issue as duplicate of #786

[c4-judge]

trust1995 marked the issue as not a duplicate

[c4-judge]

trust1995 marked the issue as duplicate of #183