CU-85ztxzhp0: decode & send the exact value for payable methods

contracts/tOFT/modules/BaseTOFTMarketModule.sol

@@ -110,6 +110,7 @@ contract BaseTOFTMarketModule is TOFTCommon {
 
         bytes32 toAddress = LzLib.addressToBytes32(to);
         (removeParams.amount, ) = _removeDust(removeParams.amount);
+
         bytes memory lzPayload = abi.encode(
             PT_MARKET_REMOVE_COLLATERAL,
             from,
@@ -182,15 +183,18 @@ contract BaseTOFTMarketModule is TOFTCommon {
 
         (uint256 amount, ) = _removeDust(borrowParams.amount);
         _debitFrom(_from, lzEndpoint.getChainId(), toAddress, amount);
-
+        (, , uint256 airdropAmount, ) = LzLib.decodeAdapterParams(
+            airdropAdapterParams
+        );
         bytes memory lzPayload = abi.encode(
             PT_YB_SEND_SGL_BORROW,
             _from,
             toAddress,
             _ld2sd(amount),
             borrowParams,
             withdrawParams,
-            approvals
+            approvals,
+            airdropAmount
         );
 
         _checkGasLimit(
@@ -226,7 +230,8 @@ contract BaseTOFTMarketModule is TOFTCommon {
             uint64 amountSD,
             ITapiocaOFT.IBorrowParams memory borrowParams,
             ICommonData.IWithdrawParams memory withdrawParams,
-            ICommonData.IApproval[] memory approvals
+            ICommonData.IApproval[] memory approvals,
+            uint256 airdropAmount
         ) = abi.decode(
                 _payload,
                 (
@@ -236,7 +241,8 @@ contract BaseTOFTMarketModule is TOFTCommon {
                     uint64,
                     ITapiocaOFT.IBorrowParams,
                     ICommonData.IWithdrawParams,
-                    ICommonData.IApproval[]
+                    ICommonData.IApproval[],
+                    uint256
                 )
             );
 
@@ -256,7 +262,8 @@ contract BaseTOFTMarketModule is TOFTCommon {
                 _to,
                 borrowParams,
                 withdrawParams,
-                approvals
+                approvals,
+                airdropAmount
             )
         );
 
@@ -280,7 +287,8 @@ contract BaseTOFTMarketModule is TOFTCommon {
         bytes32 _to,
         ITapiocaOFT.IBorrowParams memory borrowParams,
         ICommonData.IWithdrawParams memory withdrawParams,
-        ICommonData.IApproval[] memory approvals
+        ICommonData.IApproval[] memory approvals,
+        uint256 airdropAmount
     ) public payable {
         if (approvals.length > 0) {
             _callApproval(approvals);
@@ -290,7 +298,7 @@ contract BaseTOFTMarketModule is TOFTCommon {
         approve(address(borrowParams.marketHelper), borrowParams.amount);
 
         uint256 gas = withdrawParams.withdraw
-            ? (msg.value > 0 ? msg.value : address(this).balance)
+            ? (msg.value > 0 ? msg.value : airdropAmount)
             : 0;
         IMagnetar(borrowParams.marketHelper)
             .depositAddCollateralAndBorrowFromMarket{value: gas}(

contracts/tOFT/modules/BaseTOFTOptionsModule.sol

@@ -125,13 +125,16 @@ contract BaseTOFTOptionsModule is TOFTCommon {
             toAddress,
             paymentTokenAmount
         );
-
+        (, , uint256 airdropAmount, ) = LzLib.decodeAdapterParams(
+            adapterParams
+        );
         bytes memory lzPayload = abi.encode(
             PT_TAP_EXERCISE,
             _ld2sd(paymentTokenAmount),
             optionsData,
             tapSendData,
-            approvals
+            approvals,
+            airdropAmount
         );
 
         _checkGasLimit(
@@ -209,15 +212,17 @@ contract BaseTOFTOptionsModule is TOFTCommon {
                 memory optionsData,
             ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData
                 memory tapSendData,
-            ICommonData.IApproval[] memory approvals
+            ICommonData.IApproval[] memory approvals,
+            uint256 airdropAmount
         ) = abi.decode(
                 _payload,
                 (
                     uint16,
                     uint64,
                     ITapiocaOptionsBrokerCrossChain.IExerciseOptionsData,
                     ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData,
-                    ICommonData.IApproval[]
+                    ICommonData.IApproval[],
+                    uint256
                 )
             );
 
@@ -249,7 +254,8 @@ contract BaseTOFTOptionsModule is TOFTCommon {
                 optionsData.target,
                 tapSendData,
                 optionsData.paymentTokenAmount,
-                approvals
+                approvals,
+                airdropAmount
             )
         );
 
@@ -287,7 +293,8 @@ contract BaseTOFTOptionsModule is TOFTCommon {
         ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData
             memory tapSendData,
         uint256 paymentTokenAmount,
-        ICommonData.IApproval[] memory approvals
+        ICommonData.IApproval[] memory approvals,
+        uint256 airdropAmount
     ) public {
         if (approvals.length > 0) {
             _callApproval(approvals);
@@ -313,9 +320,7 @@ contract BaseTOFTOptionsModule is TOFTCommon {
             }
         }
         if (tapSendData.withdrawOnAnotherChain) {
-            ISendFrom(tapSendData.tapOftAddress).sendFrom{
-                value: address(this).balance
-            }(
+            ISendFrom(tapSendData.tapOftAddress).sendFrom{value: airdropAmount}(
                 address(this),
                 tapSendData.lzDstChainId,
                 LzLib.addressToBytes32(from),

docs/tOFT/modules/BaseTOFTMarketModule.md

@@ -186,7 +186,7 @@ function borrow(address module, uint16 _srcChainId, bytes _srcAddress, uint64 _n
 ### borrowInternal
 
 ```solidity
-function borrowInternal(bytes32 _to, ITapiocaOFT.IBorrowParams borrowParams, ICommonData.IWithdrawParams withdrawParams, ICommonData.IApproval[] approvals) external payable
+function borrowInternal(bytes32 _to, ITapiocaOFT.IBorrowParams borrowParams, ICommonData.IWithdrawParams withdrawParams, ICommonData.IApproval[] approvals, uint256 airdropAmount) external payable
 ```
 
 
@@ -201,6 +201,7 @@ function borrowInternal(bytes32 _to, ITapiocaOFT.IBorrowParams borrowParams, ICo
 | borrowParams | ITapiocaOFT.IBorrowParams | undefined |
 | withdrawParams | ICommonData.IWithdrawParams | undefined |
 | approvals | ICommonData.IApproval[] | undefined |
+| airdropAmount | uint256 | undefined |
 
 ### callOnOFTReceived
 

docs/tOFT/modules/BaseTOFTOptionsModule.md

@@ -380,7 +380,7 @@ function exercise(address module, uint16 _srcChainId, bytes _srcAddress, uint64
 ### exerciseInternal
 
 ```solidity
-function exerciseInternal(address from, uint256 oTAPTokenID, address paymentToken, uint256 tapAmount, address target, ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData tapSendData, uint256 paymentTokenAmount, ICommonData.IApproval[] approvals) external nonpayable
+function exerciseInternal(address from, uint256 oTAPTokenID, address paymentToken, uint256 tapAmount, address target, ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData tapSendData, uint256 paymentTokenAmount, ICommonData.IApproval[] approvals, uint256 airdropAmount) external nonpayable
 ```
 
 
@@ -399,6 +399,7 @@ function exerciseInternal(address from, uint256 oTAPTokenID, address paymentToke
 | tapSendData | ITapiocaOptionsBrokerCrossChain.IExerciseLZSendTapData | undefined |
 | paymentTokenAmount | uint256 | undefined |
 | approvals | ICommonData.IApproval[] | undefined |
+| airdropAmount | uint256 | undefined |
 
 ### exerciseOption