Arbitrary call with user-controlled target
Lombard Finance's assessment for RD-F-013 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No arbitrary call with user-controlled target found in examined contracts. BridgeV2.sol routes calls through defined interfaces (Hyperlane Mailbox, CCIP Router) which are admin-configured trusted addresses, not user-supplied. The GMP/AssetRouter integration uses a defined Mailbox address (0x964677F337d6528d659b1892D0045B8B27183fc0). No evidence of fully user-controlled call target. Confidence medium — peripheral contracts not fully inspected.
Sources #
- GitHubBridgeV2.sol sourceBridgeV2.sol — external calls to admin-configured mailbox and CCIP routerretrieved 2026-05-05
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →