Steal from Sponsor Vault

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/BridgeFacet.sol#L279

Vulnerability details

Impact

A approved realyer can steal from sponsor vault by self initiating transaction via xcall with little to no relayer fees. Then Relayer can himself execute the transaction and claim the fees which he gave and also from the sponsor vault. Thus stealing from sponsor vault

Proof of Concept

1. Relayer makes xcall using destination domain as his own or some other where he is the approved relayer and also have some sponsor vault

2. Since relayer fees on this transaction is very low so no relayer would be interested in taking this transaction.

3. The malicious Relayer simply execute his own transaction due to non competetion and also in process obtains the fees from sponsor vault for his own transaction

Recommended Mitigation Steps

There should be a min cap for relayer fees

[LayneHaber]

Duplicate of #234