Skip to content
Request an audit

‹ All findings

_msgSender() is mixed with msg.sender

Low/InfoMitosis·Three Sigma · Cross-chain liquidity layer 1 · 25th June, 20243S-Mitosis-L06

Description

The code is using OpenZeppelin's Context contract which is intended to allow meta-transactions. It works by using a call to _msgSender() instead of querying msg.sender directly, because the method allows those special transactions.

The problem is that the bridge adapters use msg.sender directly instead of _msgSender(). While this doesn't significantly impact the functions called from CCDMHost, as meta-transactions aren't needed there, it causes issues for users who call the adapters directly.

Recommendation

Change the code to use _msgSender() instead of msg.sender.

Status

Addressed in #445f850.