Implementation of IERC677Receiver doesn't follow the standard

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/IERC677Receiver.sol#L4-#L8
https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/StablecoinBridge.sol#L75-#L84

Vulnerability details

Impact

The receiver in IERC677 implementation should be properly checked to ensure if the address to be passed is a contract or not. The current implementation of functions doesn't cover that.

Moreover, there is no support to or implementation of ERC677 standard by Ethereum. The proposal is still in the draft stage.

Proof of Concept

Include a check to see if the address is a contract.

function isContract(address addr) internal view returns (bool) {
    uint size;
    assembly {
      size := extcodesize(addr)
    }
    return (size > 0);
  }

& revert accordingly.

Tools Used

Manual Review

Recommended Mitigation Steps

Comply with the standard, and include a check to see if the address is a contract address.
Reference Implementation

[c4-pre-sort]

0xA5DF marked the issue as low quality report

[0xA5DF]

Impact doesn't seem to be significant, also it's not clear what's the deviation from the standard.
A reference to another implementation isn't a proof for what the standard should be

[hansfriese]

High level call to an EOA will revert, so there is no impact here.

[c4-judge]

hansfriese marked the issue as unsatisfactory:
Invalid