loss of gas for the user because of not using msg.value

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/module/LayerZeroModule.sol#L241

Vulnerability details

Impact

• L241 - An ether is sent using an input of the function, it should be validated before if msgValue >= msg.value and throw a corresponding exception.
  This could cause problems, since if the user sends 10,000 weis and puts the value 1,000 weis in the parameter, he would be losing 9,000 weis in the contract that he could not recover.
  This is necessary to do since we cannot trust the Operator contract to validate it, the implementation may change.

Recommended Mitigation Steps

Make the send() function either request that msg.value == msgValue or directly use msg.value or as a last possible solution, make it return the non-excess gas.

[gzeoneth]

Valid but low risk.

[alexanderattar]

Low risk, but true. The suggestion above can be added.

[ACC01ADE]

Upon further review, (LayerZeroModule.sol#L227)(https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/module/LayerZeroModule.sol#L227) is exclusively used in HolographOperator.sol#L640. The msgValue is guaranteed to be valid and same as msg.value. No changes will be implemented to address this issue since it's not one.