rhino.fi

It is important to validate inputs to avoid human error, even if they only come from trusted addresses: 1. qs-badge-fixed In `upgrade.upgrade_contract_code_and_data()`, `data` should be validated to ensure the `owner` address is valid. Further, `code` should be validated to be non-zero. 1. qs-badge-acknowledged When processing `op::set_deposit_limit` in `bridge_contract`, there should be a check that the deposit limit being set is non-zero, or within some other reasonable bound. A deposit limit of zero would effectively inhibit all future deposits. 1. qs-badge-fixed When processing `op::transfer_ownership()` check that the address of the owner being assigned is non-zero.

A user's jetton deposit begins from their jetton wallet, sending a message to the Rhino bridge's jetton wallet to begin a deposit on their behalf. The user is expected to specify an EVM address in the `forward_payload` of this message, which represents the destination EVM wallet to which they are bridging funds to. However, if the user sends funds and a message while accidentally forgetting to include the `forward_payload`, this user's funds will be stuck in the Rhino's bridge wallet with no way of recovery besides a manual operation by the Rhino team. ``` if(forward_payload.slice_empty?()){ return(); } ```