# nativeFeeProvided < totalNativeRequired check in BridgeDeBridge::bridgeDeBridgeWithFee is incorrect Low/Info · Sherlock · Yield-tokenisation vaults · 16th December 2025 Finding L-1 of the Spectra MetaVault Bridge security review. - Protocol: https://www.spectra.finance/ - Report: /reports/spectra-metavault-bridge - Source: https://github.com/0xsimao/audits/blob/main/Sherlock/private-audits/2025-12-16-spectra-metavault.pdf --- ## Summary The `nativeFeeProvided < totalNativeRequired ` check should be `!=`. ## Vulnerability Detail The source bridge enforces that the native fee provided is exactly the amount + fee, [link](https://github.com/debridge-finance/dln-contracts/blob/main/contracts/DLN/DlnSource.sol#L585-L587). Hence, this check is not accurate. ```solidity if (_orderCreation.giveTokenAddress == address(0)) { if (msg.value != _order.giveAmount + globalFixedNativeFee) revert MismatchNativeGiveAmount(); } ``` ## Impact There is no impact other than some extra gas cost and readability, since the call will revert later. ## Code Snippet https://github.com/sherlock-audit/2025-12-spectra-metavault-update-dec-16th/pull/5/files#diff-eba31f672a0e150d33e98354d7cada4c4eb270fda831d5b53382b7eaae395260R166 ## Tool Used Manual Review ## Recommendation Change the check to be `!=`. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.](https://0xsimao.com/findings/cork-protocol-providing-actually-provided-locked): Cork Protocol - [CurveAssetManagerHelper::_validateAssets() should check that the number of assets provided is smaller than the maximum of the pool](https://0xsimao.com/findings/singularity-curve-helper-validate-provided): Singularity - [Liquidation will reduce total cds deposited amount, leading to incorrect option fees](https://0xsimao.com/findings/autonomint-liquidation-reduce-option-fees): Autonomint - [`totalEarnings` is incorrect when withdrawing after ending which will withdraw too many funds leaving the `Vault` insolvent](https://0xsimao.com/findings/saffron-lido-vaults-ending-withdraw-leaving-insolvent): Saffron Lido Vaults