Erc1155FractionFacet Manual Review Findings

EFF-01M: Inexistent Handling of Refund

Type	Severity	Location
Logical Fault		Erc1155FractionFacet.sol:L77

Description:

The Erc1155FractionFacet::transferFractions function will perform a cross-chain transaction using the Evergon Labs ODC implementation, however, any refund that will potentially be acquired if a surplus of msg.value is sent to the call is not handled as the refund address will be set to the Erc1155FractionFacet address itself (i.e. the Diamond).

Impact:

Any failed LayerZero transaction refund will be lost in the FractionalisationDiamond as it is not adequately handled.

Example:

Copy
70function transferFractions(
71    uint256 campaignId,
72    address from,
73    OmnichainAddress to,
74    uint256 id,
75    uint256 amount
76) external payable onlyInternalDelegateCall {
77    ISemiFungibleFraction(getFractionAddress(campaignId)).safeTransferFrom{value: msg.value}(from, to, id, amount, "");
78
79    emit FractionsErc1155Transferred(from, to, amount, id);
80}

Recommendation:

We advise refunds to be adequately handled, potentially by keeping track of the LayerZero request ID and evaluating whether it has resulted in a refund through the OmnichainProxy. To note, any alleviation of this exhibit would require a significant refactor of the ODC codebase to better integrate with external implementations such as the tokenizer system.

Alleviation (71cda4ccfdcfa25fb96a4565f1f8143b350dd246):

The ODC implementation of the Evergon Labs team was refactored to support an explicitly defined refund address that is in turn propagated from the Erc1155FractionFacet::transferFractions function, ensuring that a failed transaction will properly refund the failed cross-chain transfer to the appropriate address.