Address audit issues

cosmwasm/contracts/fast-transfer-gateway/src/error.rs

@@ -47,6 +47,9 @@ pub enum ContractError {
 
     #[error("Order recipient cannot be mailbox")]
     OrderRecipientCannotBeMailbox,
+
+    #[error("Duplicate order")]
+    DuplicateOrder,
 }
 
 pub type ContractResult<T> = Result<T, ContractError>;

cosmwasm/contracts/fast-transfer-gateway/src/execute.rs

@@ -100,6 +100,10 @@ pub fn initiate_settlement(
             return Err(ContractError::Unauthorized);
         }
 
+        if fills_to_settle.contains(&order_fill) {
+            return Err(ContractError::DuplicateOrder);
+        }
+
         fills_to_settle.push(order_fill);
     }
 

cosmwasm/contracts/fast-transfer-gateway/tests/test_initiate_settlement.rs

@@ -319,3 +319,37 @@ fn test_initiate_settlement_multiple_orders_fails_if_source_domains_are_differen
 
     assert_eq!(res, "Source domains must match");
 }
+
+#[test]
+fn test_initiate_settlement_fails_if_orders_are_duplicate() {
+    let (mut deps, env) = default_instantiate();
+
+    let solver_address = deps.api.with_prefix("osmo").addr_make("solver");
+
+    let order_id = HexBinary::from_hex("1234").unwrap();
+
+    state::order_fills()
+        .create_order_fill(
+            deps.as_mut().storage,
+            order_id.clone(),
+            solver_address.clone(),
+            2,
+        )
+        .unwrap();
+
+    let execute_msg = ExecuteMsg::InitiateSettlement {
+        order_ids: vec![order_id.clone(), order_id.clone()],
+        repayment_address: HexBinary::from(left_pad_bytes(
+            bech32_decode(solver_address.as_str()).unwrap(),
+            32,
+        )),
+    };
+
+    let info = mock_info(solver_address.as_str(), &[]);
+
+    let res = go_fast_transfer_cw::contract::execute(deps.as_mut(), env, info, execute_msg.clone())
+        .unwrap_err()
+        .to_string();
+
+    assert_eq!(res, "Duplicate order");
+}

solidity/src/FastTransferGateway.sol

@@ -266,6 +266,8 @@ contract FastTransferGateway is Initializable, UUPSUpgradeable, OwnableUpgradeab
     /// @param repaymentAddress The address to repay the orders to
     /// @param orderIDs The IDs of the orders to settle
     function initiateSettlement(bytes32 repaymentAddress, bytes memory orderIDs) public payable {
+        _checkForDuplicateOrders(orderIDs);
+
         uint32 sourceDomain;
         for (uint256 pos = 0; pos < orderIDs.length; pos += 32) {
             bytes32 orderID;
@@ -501,5 +503,25 @@ contract FastTransferGateway is Initializable, UUPSUpgradeable, OwnableUpgradeab
         return orderFill;
     }
 
+    function _checkForDuplicateOrders(bytes memory orderIDs) internal pure {
+        for (uint256 pos = 0; pos < orderIDs.length; pos += 32) {
+            bytes32 orderID;
+            assembly {
+                orderID := mload(add(orderIDs, add(0x20, pos)))
+            }
+
+            for (uint256 pos2 = pos + 32; pos2 < orderIDs.length; pos2 += 32) {
+                bytes32 orderID2;
+                assembly {
+                    orderID2 := mload(add(orderIDs, add(0x20, pos2)))
+                }
+
+                if (orderID2 == orderID) {
+                    revert("FastTransferGateway: duplicate order");
+                }
+            }
+        }
+    }
+
     function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
 }

solidity/test/FastTransferGateway.t.sol

@@ -894,6 +894,45 @@ contract FastTransferGatewayTest is Test {
         vm.stopPrank();
     }
 
+    function test_revertInitiateSettlementOnDuplicateOrder() public {
+        uint32 sourceDomain = 8453;
+        bytes32 sourceContract = TypeCasts.addressToBytes32(address(0xB));
+
+        gateway.setRemoteDomain(sourceDomain, sourceContract);
+
+        FastTransferOrder memory orderA = FastTransferOrder({
+            sender: TypeCasts.addressToBytes32(address(0xB)),
+            recipient: TypeCasts.addressToBytes32(address(0xC)),
+            amountIn: 100_000000,
+            amountOut: 98_000000,
+            nonce: 1,
+            sourceDomain: sourceDomain,
+            destinationDomain: 1,
+            timeoutTimestamp: block.timestamp + 1 days,
+            data: bytes("")
+        });
+
+        deal(address(usdc), solver, orderA.amountOut + orderA.amountOut, true);
+        deal(solver, 1 ether);
+
+        bytes memory orderIDs;
+        orderIDs = bytes.concat(orderIDs, OrderEncoder.id(orderA));
+        orderIDs = bytes.concat(orderIDs, OrderEncoder.id(orderA));
+
+        uint256 hyperlaneFee =
+            gateway.quoteInitiateSettlement(sourceDomain, TypeCasts.addressToBytes32(solver), orderIDs);
+
+        vm.startPrank(solver);
+
+        usdc.approve(address(gateway), orderA.amountOut + orderA.amountOut);
+
+        gateway.fillOrder(solver, orderA);
+
+        vm.expectRevert("FastTransferGateway: duplicate order");
+        gateway.initiateSettlement{value: hyperlaneFee}(TypeCasts.addressToBytes32(solver), orderIDs);
+        vm.stopPrank();
+    }
+
     function test_initiateTimeout() public {
         uint32 sourceDomain = 8453;
         bytes32 sourceContract = TypeCasts.addressToBytes32(address(0xB));