@@ -5,7 +5,7 @@ import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
5
5
6
6
import "../interfaces/IWormhole.sol " ;
7
7
import "../interfaces/IWormholeReceiver.sol " ;
8
- import "../interfaces/ICoreRelayer .sol " ;
8
+ import "../interfaces/IWormholeRelayer .sol " ;
9
9
10
10
/**
11
11
* This contract is a malicious "integration" that attempts to attack the forward mechanism.
@@ -14,15 +14,15 @@ contract AttackForwardIntegration is IWormholeReceiver {
14
14
mapping (bytes32 => bool ) consumedMessages;
15
15
address attackerReward;
16
16
IWormhole wormhole;
17
- ICoreRelayer core_relayer;
17
+ IWormholeRelayer core_relayer;
18
18
uint32 nonce = 1 ;
19
19
uint16 targetChainId;
20
20
21
21
// Capture 30k gas for fees
22
22
// This just needs to be enough to pay for the call to the destination address.
23
23
uint32 SAFE_DELIVERY_GAS_CAPTURE = 30000 ;
24
24
25
- constructor (IWormhole initWormhole , ICoreRelayer initCoreRelayer , uint16 chainId , address initAttackerReward ) {
25
+ constructor (IWormhole initWormhole , IWormholeRelayer initCoreRelayer , uint16 chainId , address initAttackerReward ) {
26
26
attackerReward = initAttackerReward;
27
27
wormhole = initWormhole;
28
28
core_relayer = initCoreRelayer;
@@ -39,25 +39,25 @@ contract AttackForwardIntegration is IWormholeReceiver {
39
39
// The core relayer could in principle accept the request due to this being the target of the message at the same time as being the refund address.
40
40
// Note that, if succesful, this forward request would be processed after the time for processing forwards is past.
41
41
// Thus, the request would "linger" in the forward request cache and be attended to in the next delivery.
42
- requestForward (targetChainId, toWormholeFormat (attackerReward));
42
+ forward (targetChainId, toWormholeFormat (attackerReward));
43
43
}
44
44
45
- function requestForward (uint16 targetChain , bytes32 attackerRewardAddress ) internal {
46
- uint256 computeBudget = core_relayer.quoteGasDeliveryFee (
45
+ function forward (uint16 targetChain , bytes32 attackerRewardAddress ) internal {
46
+ uint256 maxTransactionFee = core_relayer.quoteGas (
47
47
targetChain, SAFE_DELIVERY_GAS_CAPTURE, core_relayer.getDefaultRelayProvider ()
48
48
);
49
49
50
- ICoreRelayer.DeliveryRequest memory request = ICoreRelayer. DeliveryRequest ({
50
+ IWormholeRelayer.Send memory request = IWormholeRelayer. Send ({
51
51
targetChain: targetChain,
52
52
targetAddress: attackerRewardAddress,
53
53
// All remaining funds will be returned to the attacker
54
54
refundAddress: attackerRewardAddress,
55
- computeBudget: computeBudget ,
56
- applicationBudget : 0 ,
55
+ maxTransactionFee: maxTransactionFee ,
56
+ receiverValue : 0 ,
57
57
relayParameters: core_relayer.getDefaultRelayParams ()
58
58
});
59
59
60
- core_relayer.requestForward {value: computeBudget }(request, nonce, core_relayer.getDefaultRelayProvider ());
60
+ core_relayer.forward {value: maxTransactionFee }(request, nonce, core_relayer.getDefaultRelayProvider ());
61
61
}
62
62
63
63
function toWormholeFormat (address addr ) public pure returns (bytes32 whFormat ) {
0 commit comments