PaintSwap Audit: Cross-Chain Security Review

  function _credit(address to, uint256 amount, uint32 /* srcEid */) internal override returns (uint256) {
    // Phase 2: Reject unlocks
    require(block.timestamp < _burnStartTimestamp, InvalidState());Fantom will revert/fail as the outbound message size is limited to `1` bytes, and hence, it
    ....
  }

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import {Test, console} from "forge-std/Test.sol";

interface IUln {
    struct ExecutorConfig {
        uint32 maxMessageSize;
        address executor;
    }

    function getExecutorConfig(address _oapp, uint32 _remoteEid) external view returns (ExecutorConfig memory rtnConfig);
}

interface IEndpoint {
    struct SetConfigParam {
        uint32 eid;
        uint32 configType;
        bytes config;
    }

    function setConfig(address _oapp, address _lib, SetConfigParam[] calldata _params) external;
}

interface IBrushAdapter {
    function burnRemainingTokens() external;
    
    error BurnCompleted();
}

interface IBrush {
    error NoPeer(uint32 eid);
    error LZ_MessageLib_InvalidMessageSize(uint256 actual, uint256 max);

    struct SendParam {
        uint32 dstEid; // Destination endpoint ID.
        bytes32 to; // Recipient address.
        uint256 amountLD; // Amount to send in local decimals.
        uint256 minAmountLD; // Minimum amount to send in local decimals.
        bytes extraOptions; // Additional options supplied by the caller to be used in the LayerZero message.
        bytes composeMsg; // The composed message for the send() operation.
        bytes oftCmd; // The OFT command to be executed, unused in default OFT implementations.
    }

    struct MessagingFee {
        uint256 nativeFee;
        uint256 lzTokenFee;
    }

    struct MessagingReceipt {
        bytes32 guid;
        uint64 nonce;
        MessagingFee fee;
    }

    struct OFTReceipt {
        uint256 amountSentLD; // Amount of tokens ACTUALLY debited from the sender in local decimals.
        // @dev In non-default implementations, the amountReceivedLD COULD differ from this value.
        uint256 amountReceivedLD; // Amount of tokens to be received on the remote side.
    }

    function send(
        SendParam calldata _sendParam,
        MessagingFee calldata _fee,
        address _refundAddress
    ) external payable returns (MessagingReceipt memory, OFTReceipt memory);
}

contract ForkTest is Test {
    uint256 ftmFork;
    uint256 sonicFork;

    IBrushAdapter public brushAdapter;
    IBrush public brush;
    IUln public uln;
    IEndpoint public endpoint;

    function setUp() public {
        sonicFork = vm.createSelectFork("https://rpc.soniclabs.com");
        brush = IBrush(0xE51EE9868C1f0d6cd968A8B8C8376Dc2991BFE44);
        uln = IUln(0xC39161c743D0307EB9BCc9FEF03eeb9Dc4802de7);
        endpoint = IEndpoint(0x6F475642a6e85809B1c36Fa62763669b1b48DD5B);


        ftmFork = vm.createSelectFork("https://rpc.fantom.network");
        brushAdapter = IBrushAdapter(0x9D92cD1A5Cea3147e5Bf47EfF2D2C632C9839267);
    }

    function test_get_ulnconfig() public {
        vm.selectFork(sonicFork);
        uln.getExecutorConfig(address(brush), 30112); // 30112 is fantom

        /// increase it by current delegate
        vm.startPrank(0x3F64e0E81853d8913f7e646c13Dd7B28411DCB11);
        IEndpoint.SetConfigParam[] memory param = new IEndpoint.SetConfigParam[](1);
        param[0] = IEndpoint.SetConfigParam(30112, 1, abi.encode(IUln.ExecutorConfig(10000, 0x4208D6E27538189bB48E603D6123A94b8Abe0A0b)));
        
        endpoint.setConfig(address(brush), address(uln), param);
        uln.getExecutorConfig(address(brush), 30112); // 30112 is fantom

        deal(0xa801864d0D24686B15682261aa05D4e1e6e5BD94, 100 ether);
        deal(address(brush),0xa801864d0D24686B15682261aa05D4e1e6e5BD94, 1000000000000000000);

        IBrush.SendParam memory sendParam = IBrush.SendParam(
            uint32(30112),
            0x000000000000000000000000a801864d0d24686b15682261aa05d4e1e6e5bd94,
            1000000000000000000,
            1000000000000000000,
            hex"00030100110100000000000000000000000000030d40",
            "",
            ""
        );

        IBrush.MessagingFee memory feeParam = IBrush.MessagingFee(91863684834412189, 0);

        vm.startPrank(0xa801864d0D24686B15682261aa05D4e1e6e5BD94);
        brush.send{value: feeParam.nativeFee}(
            sendParam,
            feeParam,
            0xa801864d0D24686B15682261aa05D4e1e6e5BD94
        );
    }
}

## BrushOFTAdapter.sol

  function _credit(address to, uint256 amount, uint32 /* srcEid */) internal override returns (uint256) {
    // Phase 2: Reject unlocks
>>>    require(block.timestamp < _burnStartTimestamp, InvalidState());

    emit BridgeIn(to, amount);

    // Phase 1: Unlock tokens
    require(innerToken.transfer(to, amount), TokenTransferFailed());

    return amount;
  }

function _credit(address _to, uint256 _amountLD, uint32 /*_srcEid*/) internal virtual override returns (uint256 amountReceivedLD) {
    if (_to == address(0x0)) _to = address(0xdead); // _mint(...) does not support address(0x0)
    _mint(_to, _amountLD);
    return _amountLD;
}

event BridgeIn(address indexed to, uint256 amount);
event BridgeOut(address indexed from, uint256 amount);

function burnFrom(address account, uint256 amount) public {
  ....
}

- function burnFrom(address account, uint256 amount) public {
+ function burnFrom(address account, uint256 amount) external {