Potential overpayment in bridgeLayerZeroOFT

[iamkunal9]

I noticed that bridgeLayerZeroOFT in LayerZeroOFT.sol:21 uses selfbalance() as msg.value when calling the OFT contract:
call(gas(), oft, selfbalance(), ...)
But the integration test expects the exact quoted fee to be sent:
vm.expectCall(oft, fee, abi.encodeCall(IOFT.send, ...));
Is this intentional? If the BridgeSettler holds any residual ETH from previous actions, wouldn't the entire balance get sent as the fee instead of just the quoted amount?
Just want to understand if there's a guarantee that selfbalance() always equals messagingFee.nativeFee at call time, or if this might be an issue.

[iamkunal9]

cc: @duncancmt

[e1Ru1o]

Fair concern. LayerZero allows to pass a refundAddress where any excess is returned. This is expected to be used properly. See here. Also the upcoming update on bridgeLayerZeroOFT adds a nativeFee parameter. Check the PR here

[e1Ru1o]

Just for extra clarity here. There is no loss of funds, native or ERC20, by the taker in the presence of this functionality. In the native case, refundAddress is trusted by the taker (signed by the taker) and the excess is returned to that address. In case or ERC20 the full amount is bridged.

The new PR introduces support for OFTs that are wrappers of Native token, which means that, it might happen that no ERC20 is involved in the bridge operation. The main change to enable this was the introduction of a nativeFee parameter, so now, there is not fee overpayment in the case of ERC20 and neither in the case of Native tokens, in which case, anything above the nativeFee is going to be bridged.

Let us know if there is anything else to discuss or if this issue can be closed.

[iamkunal9]

will review the latest PR but apart from that I agree with your assessment.

[iamkunal9]

Closing this 👍