BranchBridgeAgent invokes anyCall with PAY ON SOURCE but doesn't send value with it. All calls will fail.

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1006-L1011
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/lib/AnycallFlags.sol#L11

Vulnerability details

Impact

IAnycallProxy().anyCall() operates under one of two modes of taking fees, namely fees are taken either on source or on the destination chain. Fee mode is decided by the caller with an appropriate value of the fourth parameter, ie. uint256 _flag . Values 0,4 denote the SOURCE chain. Such invocation require ether to be send along (IAnycallProxy().anyCall() is payable) and in case of insufficient value being sent will fail.

    function anyCall(
        address _to,
        bytes calldata _data,
        uint256 _toChainID,
        uint256 _flags,
        bytes calldata _extdata
    ) external payable;

BranchBridgeAgent._performCall() invokes anyCall() with AnycallFlags.FLAG_ALLOW_FALLBACK which is defined as 0x1 << 2 ie 4

source: BranchBridgeAgent.sol

    function _performCall(bytes memory _calldata) internal virtual {
        //Sends message to AnycallProxy
        IAnycallProxy(localAnyCallAddress).anyCall(
            rootBridgeAgentAddress, _calldata, rootChainId, AnycallFlags.FLAG_ALLOW_FALLBACK, ""
        );
    }

source: AnycallFlags.sol

    uint256 public constant FLAG_ALLOW_FALLBACK = 0x1 << 2;

Consequently all cross bridge requests will fail.

Tools Used

Manual review, Multichain documentation: (Link to anyCall flags definition)[https://docs.multichain.org/developer-guide/anycall-v7/quickstart-cross-chain-text-example]

Recommended Mitigation Steps

Judging from the RootBridgeAgent.anyExecute() implementation the intended mode is to pay fees on the destination chain (with fallback enabled). Under this assumption _flag = 6 should be passed ie.
AnycallFlags.FLAG_ALLOW_FALLBACK_DST

Assessed type

Other

[c4-judge]

trust1995 marked the issue as duplicate of #91

[c4-judge]

trust1995 marked the issue as satisfactory