Incorrect argument order in CrossChainHandleResult event emission leads to incorrect cross-chain message finalization

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-chakra/blob/abef77d95866f2fec93270491fc5abc9ab14f86d/solidity/settlement/contracts/ChakraSettlement.sol#L238-L241

Vulnerability details

Impact

When a cross-chain ERC20 transfer is initiated, the destination ChakraSettlement contract processes the message via the receive_cross_chain_msg function and emits a CrossChainHandleResult event. This event is crucial for Chakra validators, as they rely on its arguments to correctly call ChakraSettlement::receive_cross_chain_callback on the source chain to finalize the message.

The issue lies in the incorrect ordering of arguments in the CrossChainHandleResult event. This misordering causes the validators to pass incorrect values to the receive_cross_chain_callback function, leading to improper message finalization:

// cross chain handle result emit by receive side
event CrossChainHandleResult(
    uint256 indexed txid,
    CrossChainMsgStatus status,
    string from_chain,
    string to_chain,
    address from_handler,
    uint256 to_handler,
    PayloadType payload_type
);

function receive_cross_chain_msg(
    uint256 txid,
    string memory from_chain,
    uint256 from_address,
    uint256 from_handler,
    address to_handler,
    PayloadType payload_type,
    bytes calldata payload,
    uint8 sign_type, // validators signature type /  multisig or bls sr25519
    bytes calldata signatures // signature array
) external {
    // --SNIP

    emit CrossChainHandleResult(
        txid,
        status,
>>>        contract_chain_name, // @audit this should be `from_chain`
>>>        from_chain,          // @audit this should be `contract_chain_name`
>>>        address(to_handler), // @audit this should be `from_handler`
>>>        from_handler,        // @audit this should be `to_handler`
        payload_type
    );
}

As shown above, the receive_cross_chain_msg function incorrectly sets the arguments in the CrossChainHandleResult event. When Chakra validators capture this event and use it to call receive_cross_chain_callback on the source chain, the wrong values are passed to the function. For instance, the from_chain argument in the event emission in receive_cross_chain_callback ends up referring to the source chain itself, rather than the intended destination chain that handled the receive message.

Tools Used

Manual Review

Recommended Mitigation Steps

Ensure that the arguments in the CrossChainHandleResult event are correctly ordered:

function receive_cross_chain_msg(
   uint256 txid,
   string memory from_chain,
   uint256 from_address,
   uint256 from_handler,
   address to_handler,
   PayloadType payload_type,
   bytes calldata payload,
   uint8 sign_type, // validators signature type /  multisig or bls sr25519
   bytes calldata signatures // signature array
) external {
   // --SNIP

   emit CrossChainHandleResult(
       txid,
       status,
-       contract_chain_name, 
-       from_chain,          
-       address(to_handler), 
-       from_handler,    
+       from_chain,
+       contract_chain_name,
+       from_handler,
+       address(to_handler)    
      payload_type

   );
}

Assessed type

Other

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-b