# `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` always charges twice the collateral on `COLLATERAL_TRANSFER`, which is not needed Medium · Sherlock · Hedged stablecoin · 4th December 2024 Finding M-24 of the Autonomint competition. - Protocol: https://audits.sherlock.xyz/contests/569 - Report: /reports/autonomint - Codebase: https://github.com/0xsimao/2024-11-autonomint/tree/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b - Source: https://github.com/sherlock-audit/2024-11-autonomint-judging/issues/798 --- ### Summary `GlobalVariables::oftOrCollateralReceiveFromOtherChains()` frequently occurs losses by forwarding too much ETH as it assumes collateral transfer always happen for the 2 tokens + eth, which is not true as it can just be ETH and it skips collateral transfers when the amount is [null](https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/GlobalVariables.sol#L606). This will happen on liquidations for example as the collateral my just be ETH and it needs to fetch ETH from the other chain, so the other chain will only send ETH and the 2 other collateral transfers can be skipped. However, they will still be payed here, taking the user the loss. ### Root Cause In `GlobalVariables.sol:290/300`, collateral transfers are always charged even if amounts to send are null. ### Internal pre-conditions None. ### External pre-conditions None. ### Attack Path 1. Borrower is liquidated and had deposited ETH. 2. Chain does not have enough ETH and requests from other chain. It pays for 2 extra collateral transfers. 3. Other chain sends ETH and will have leftover native. ### Impact Losses keep being accrued as it overcharges fees. ### PoC See links above. ### Mitigation Check if the amount is null and only charge fees for both collateral tokens if the amount is non null. --- Related findings: - [Implement _transferShares() to prevent having to convert shares/wAVAX twice in glAVAX](https://0xsimao.com/findings/glacier-transfer-shares-convert-twice): Glacier - [TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market](https://0xsimao.com/findings/tapioca-dao-toft-stolen-collateral-params): Tapioca DAO - [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share): Fuji Finance - [Mismatching calldata in _crossTransferWithCalldata(...) and xReceive(...) in ConnextRouter](https://0xsimao.com/findings/fuji-finance-mismatching-calldata-cross-transfer): Fuji Finance