Skip to content
Request an audit

‹ All findings

nativeFeeProvided < totalNativeRequired check in BridgeDeBridge::bridgeDeBridgeWithFee is incorrect

Low/InfoSpectra MetaVault Bridge·Sherlock·Yield-tokenisation vaults·16th December 2025·by 0xSimaoL-1

Summary

The nativeFeeProvided < totalNativeRequired check should be !=.

Vulnerability Detail

The source bridge enforces that the native fee provided is exactly the amount + fee, link. Hence, this check is not accurate.

solidity
if (_orderCreation.giveTokenAddress == address(0)) {
    if (msg.value != _order.giveAmount + globalFixedNativeFee) revert MismatchNativeGiveAmount();
}

Impact

There is no impact other than some extra gas cost and readability, since the call will revert later.

Code Snippet

https://github.com/sherlock-audit/2025-12-spectra-metavault-update-dec-16th/pull/5/files#diff-eba31f672a0e150d33e98354d7cada4c4eb270fda831d5b53382b7eaae395260R166

Tool Used

Manual Review

Recommendation

Change the check to be !=.