Responses to Kinetex audit points, iteration #1

Sources: https://github.com/KinetexNetwork/flash-contracts-audit/tree/d77ae0e1ed100bd4445c4a69a45002c97648d057

Points: https://gnosischain.notion.site/Kinetex-Audit-6e638db078494082afa9b05f001b5228

Fixed: https://github.com/KinetexNetwork/flash-contracts-audit/tree/fix-audit

Table of Contents

• [High] Re-entrancy attack on native liquidation
• [High] BitcoinProofVerifier wrongly assumes ASSET_NO_SEND_SIG is sent by order.fromActor
• [Med] Miss-aligned incentives for Bitcoin send event report
• [Info] Limited support for ERC1271
• [Info] CollateralUnlocker._sendBalance() may run out of gas
• [Info] Unfilled order sends collateral to order.fromActorReceiver which may be unexpected on collateral chain
• [Info] Wormhole cross-chain payload send does not refund overpaid gas
• [Info] ZetaChain onZetaRevert() is implemented in wrong contract
• [Info] ZetaChain getZetaFromEth() can be sandwiched due to no slippage
• Hard-coded hash constants
• Unused externalUnlockCounter in CollateralLocker
• CollateralUnlocker.rejectUnlock() and _sendBalance() inconsistent arguments
• GnosisChain Capella slot should be updated before deployment

Responses

[High] Re-entrancy attack on native liquidation