# `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` calculates the fee as if it was the same in both chains, which is false Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-23 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/795 --- ### Summary `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` send a message to the other chain requesting token/eth transfers to the current chain. In the process, it forwards ETH to pay for the cross chain transfer from the destination to the current chain. However, it calculates the fee as if the direction was current to destination, when in reality it is the opposite and the fee will be different. Thus, it will either overchage or revert in the destination chain. ### Root Cause In `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` fee is calculated as if the [direction](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/GlobalVariables.sol#L250) is current to destination, when it is the opposite. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` is called, but the fee is incorrectly calculated. ### Impact Overcharging of the fee or charging too little, which will lead to reverts on the destination chain. ### PoC See links. ### Mitigation Add a variable admin set to track the costs. --- Related findings: - [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share): Fuji Finance - [TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market](https://0xsimao.com/findings/tapioca-dao-toft-stolen-collateral-params): Tapioca DAO - [mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee](https://0xsimao.com/findings/tapioca-dao-rebalanced-balancer-eth-fee): Tapioca DAO - [Anyone can frontrun a relayer interaction with the same arguments but a much higher/lower relayer fee](https://0xsimao.com/findings/singularity-frontrun-relayer-interaction-fee): Singularity