audit h02

protocol/contracts/interfaces/templegold/ITempleGold.sol

@@ -141,7 +141,6 @@ interface ITempleGold is IOFT, IOAppCore, IOAppOptionsType3, IERC20 {
 
     /**
      * @notice Burn and update circulating supply on source chain
-     * @dev Caller must be authorized. eg. spice auction
      * @param amount Amount to burn
      */
     function burn(uint256 amount) external;

protocol/contracts/templegold/SpiceAuction.sol

@@ -379,12 +379,16 @@ contract SpiceAuction is ISpiceAuction, AuctionBase, ReentrancyGuard {
         EpochInfo storage epochInfo = epochs[epochId];
         if (epochInfo.startTime == 0) { revert InvalidEpoch(); }
         if (!epochInfo.hasEnded()) { revert AuctionActive(); }
+
+        SpiceAuctionConfig storage _config = auctionConfigs[epochId];
+        (address bidToken,) = _getBidAndAuctionTokens(_config);
+        if (bidToken != templeGold) { revert CommonEventsAndErrors.InvalidParam(); }
         uint256 amount = epochInfo.totalBidTokenAmount;
         if (amount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
 
         emit RedeemedTempleGoldBurned(epochId, amount);
         redeemedEpochs[epochId] = true;
-        _burnAndNotify(amount, useContractEth);
+        _burnAndNotify(amount, _config.recipient, useContractEth);
     }
 
     /**
@@ -435,7 +439,9 @@ contract SpiceAuction is ISpiceAuction, AuctionBase, ReentrancyGuard {
             : (templeGold, spiceToken);
     }
 
-    function _burnAndNotify(uint256 amount, bool useContractEth) private {
+    function _burnAndNotify(uint256 amount, address from, bool useContractEth) private {
+        // pull funds from bids recipient (set in config)
+        IERC20(templeGold).safeTransferFrom(from, address(this), amount);
         // burn directly and call TempleGold to update circulating supply
         if (block.chainid == _mintChainId) {
             ITempleGold(templeGold).burn(amount);

protocol/contracts/templegold/TempleGold.sol

@@ -329,11 +329,9 @@ import { TempleMath } from "contracts/common/TempleMath.sol";
 
     /**
      * @notice Burn and update circulating supply on source chain
-     * @dev Caller must be authorized. eg. spice auction
      * @param amount Amount to burn
      */
     function burn(uint256 amount) external override onlyArbitrum {
-        if (!authorized[msg.sender]) { revert CommonEventsAndErrors.InvalidAccess(); }
         _burn(msg.sender, amount);
         _updateCirculatingSupply(msg.sender, amount);
     }
@@ -364,7 +362,7 @@ import { TempleMath } from "contracts/common/TempleMath.sol";
             // already checked destination Eid for burn case in `send`
             // update circulating supply
             // _origin.sender is spice auction
-            _updateCirculatingSupply(_origin.sender.bytes32ToAddress(), _message.amountSD());
+            _updateCirculatingSupply(_origin.sender.bytes32ToAddress(), _toLD(_message.amountSD()));
         } else {
             /// @dev The src sending chain doesnt know the address length on this chain (potentially non-evm)
             // Thus everything is bytes32() encoded in flight.
@@ -378,8 +376,8 @@ import { TempleMath } from "contracts/common/TempleMath.sol";
 
     function _updateCirculatingSupply(address sender, uint256 amount) private {
         uint256 _totalBurnedCache = _totalBurnedFromSpiceAuctions = _totalBurnedFromSpiceAuctions + amount;
-        uint256 _circulatingSuppplyCache = _circulatingSupply = _circulatingSupply - amount;
-        emit CirculatingSupplyUpdated(sender, amount, _circulatingSuppplyCache, _totalBurnedCache);
+        uint256 _circulatingSupplyCache = _circulatingSupply = _circulatingSupply - amount;
+        emit CirculatingSupplyUpdated(sender, amount, _circulatingSupplyCache, _totalBurnedCache);
     }
 
     modifier onlyArbitrum() {