[L-01] Lack of Validation On Linked Messengers

[grasphoper]

Note: added a part of suggested change: IOFT validation on AdapterStore.sol side

---

In the SpokePool contract, there is no standard way of checking whether a contract supports specific interfaces or features. In particular, when adding a messenger, the single check being performed is whether the input address matches its token function against the one passed. As the token function is pretty common in a diverse set of contracts, a contract could be mistakenly passed that implements a token function and retrieves the particular token, but is not an IOFT type of contract. In such a scenario, the assignment will pass but will result in unexpected situations.

In the Ethereum ecosystem, more thorough validation can be accomplished if a contract is compliant with EIP-165. An interface is a collection of functions that define a set of behaviors. By implementing a standard, contracts can expose a function to query whether they support specific interfaces, making it easier for other contracts to understand their capabilities. Since messengers might be upgraded and new functionality can be added to existing contracts, this standardization would also allow new versions to ensure backward compatibility.

Furthermore, the IOFT interface does define the interface ID, which could be used to complement such validation when setting the messengers. Also, note that in the AdapterStore contract, the messengers added through any of the functions are not being checked as they are in the SpokePool contract.

Consider defining and implementing a standard interface detection mechanism in modules that interact with external contracts to improve their overall usability, safety, and efficiency by providing a consistent way for contracts to query and identify the features they support. Moreover, consider performing the same verification in the AdapterStore contract to be consistent with the messengers' additions.