fix(protocol): fix a bug reported by Quillaudit

[dantaik]

@adaki2004 Dani, this is a clear bug, but how come our A5 test bridge still works? or does it? Maybe you and @KorbinianK can take a look at some ERC20 bridge txs to check who received the bridged tokens.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
bridge-ui-v2-a5	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 11, 2023 0:48am

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
bridge-ui-v2-internal	⬜️ Ignored (Inspect)	Visit Preview		Oct 11, 2023 0:48am

[adaki2004]

@adaki2004 Dani, this is a clear bug, but how come our A5 test bridge still works? or does it? Maybe you and @KorbinianK can take a look at some ERC20 bridge txs to check who received the bridged tokens.

It indeed a bug but not modifying the working behavior by nature.

1. So when we call on the source chain sendToken it will trigger:

    function _encodeDestinationCall(
        address user,
        address token,
        address to,
        uint256 amount
    )

it basically puts together the receiveToken() parameters to be called with on the destination chain.

2. The receiveToken() params as follows:

    function receiveToken(
        CanonicalERC20 calldata ctoken,
        address from,
        address to,
        uint256 amount
    )

The user address in this case will be 0, but it does not matter (technically) because we use the from only in the even emitted, so not modifying the working behavior.

Good catch, it shall be indexable and so we need to fill this properly!

[dantaik]

But we use the to address to send tokens/Ether, right? So it matters and user should not have received any tokens after briding.

[adaki2004]

But we use the to address to send tokens/Ether, right? So it matters and user should not have received any tokens after briding.

Yes, but the to address is correct. This (incorrect) represents the from address in this receiveToken() call, which only used in the event emitted.