Skip to content

Conversation

@nicholaspai
Copy link
Member

Issue:

  • [N07] payable multicall function disallows msg.value
    • The MultiCaller contract is inherited by the HubPool and SpokePool contracts. It provides the public
      multiCall function that facilitates calling multiple methods within the same contract with only a single
      call.
    • However, although it is designated as a payable function, it disallows any calls that send ETH, ie where
      msg.value is not zero.
    • This effectively makes the payable designation moot and the contradictory indications could lead to
      confusion.
    • In the context of the HubPool, specifically, relays destined for chains where ETH is required and where
      a call to loadEthForL2Calls is therefore necessary, will not be multi-callable.
      Consider either explicitly noting this limitation, or removing both the require statement and the
      payable designation.

Resolution:

  • Document payable functions that would naturally be included in multicall bundles, such as loadEthForL2Calls, this issue.

@nicholaspai nicholaspai added the OZ Audit - March Resolves issue discovered in March 2022 OZ Audit label Mar 15, 2022
Co-authored-by: Chris Maree <christopher.maree@gmail.com>
@nicholaspai nicholaspai requested a review from mrice32 March 16, 2022 15:45
Co-authored-by: Chris Maree <christopher.maree@gmail.com>
Copy link
Contributor

@mrice32 mrice32 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OZ Audit - March Resolves issue discovered in March 2022 OZ Audit

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants