Description

The initialize function initializes several crucial state variables of the Bridge contract, such as threshold, minAmount, and maxAmount. The minAmount and maxAmount variables define the minimum and maximum values of funds that can be transferred to another chain via the bridge. However, the initialize function does not check whether maxAmount is greater than or equal to minAmount.

[...]
minAmount = _minAmount;
maxAmount = _maxAmount;
for (uint256 i = 0; i < _validators.length; ++i) {
    validators[_validators[i]] = true;
}
threshold = _threshold;
whitelistTokens[address(0)] = true;
[...]

Impact

These state variables can be modified later through setter functions. However, if the contract is initialized with incorrect values, it may be subtle and difficult to notice the issue, and the lock function will remain unusable until the values are corrected.

Recommendations

Add the following check to the initialize function.

require(_minAmount <= _maxAmount, "Invalid minAmount");

Remediation

This issue has been acknowledged by Sotatek, and a fix was implemented in commit 17162c1a↗.