LayerZero Channel can be blocked by an attacker

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/module/LayerZeroModule.sol#L180

Vulnerability details

Impact

According to the LayerZero docs, the default behavior is that when a transaction on the destination application fails, the channel between the source and destination is blocked. Before any new transactions can be executed, the failed transaction has to be retried until it succeeds.

See https://layerzero.gitbook.io/docs/faq/messaging-properties#message-ordering & https://layerzero.gitbook.io/docs/guides/advanced/nonblockinglzapp

An attacker is able to initiate a transaction they know will fail to block the channel.

Proof of Concept

The LayerZeroModule does not have the non-blocking approach as seen here

Example implementation here by LayerZero here

Tools Used

VSCode

Recommended Mitigation Steps

Use the non-blocking approach as described here.
Reference for similar error here

[Picodes]

Seems to be a copy paste from a previous contest (Velodrome if I recall correctly). No PoC of how a transaction could revert on the source chain.

[gzeoneth]

Duplicate of #244