[M-02] Compromised Messengers Cannot Be Removed

contracts/SpokePool.sol

@@ -1738,7 +1738,7 @@ abstract contract SpokePool is
     }
 
     function _setOftMessenger(address _token, address _messenger) internal {
-        if (IOFT(_messenger).token() != _token) {
+        if (_messenger != address(0) && IOFT(_messenger).token() != _token) {
             revert OFTTokenMismatch();
         }
         oftMessengers[_token] = _messenger;

test/evm/foundry/local/Universal_SpokePool.t.sol

@@ -305,6 +305,28 @@ contract UniversalSpokePoolTest is Test {
         assertEq(spokePool.oftMessengers(address(usdt)), address(oftMessenger));
     }
 
+    function testSetOftMessenger_removeMessenger() public {
+        IOFT oftMessenger = IOFT(new MockOFTMessenger(address(usdt)));
+        bytes memory message = abi.encodeWithSignature(
+            "setOftMessenger(address,address)",
+            address(usdt),
+            address(oftMessenger)
+        );
+        bytes memory value = abi.encode(address(spokePool), message);
+        helios.updateStorageSlot(spokePool.getSlotKey(nonce), keccak256(value));
+        spokePool.executeMessage(nonce, value, 100);
+        assertEq(spokePool.oftMessengers(address(usdt)), address(oftMessenger));
+
+        nonce++;
+
+        // Remove the messenger by setting to address(0)
+        message = abi.encodeWithSignature("setOftMessenger(address,address)", address(usdt), address(0));
+        value = abi.encode(address(spokePool), message);
+        helios.updateStorageSlot(spokePool.getSlotKey(nonce), keccak256(value));
+        spokePool.executeMessage(nonce, value, 100);
+        assertEq(spokePool.oftMessengers(address(usdt)), address(0));
+    }
+
     function testNonZeroLzFee() public {
         // Mock an OFT messenger that returns a non-zero lzTokenFee
         MockOFTMessenger oftMessengerWithNonZeroLzFee = new MockOFTMessenger(address(usdt));

test/evm/hardhat/chain-adapters/Arbitrum_Adapter.ts

@@ -56,7 +56,7 @@ let l1ERC20GatewayRouter: FakeContract,
 const arbitrumChainId = CHAIN_IDs.ARBITRUM;
 const oftArbitrumEid = getOftEid(arbitrumChainId);
 
-describe.only("Arbitrum Chain Adapter", function () {
+describe("Arbitrum Chain Adapter", function () {
   beforeEach(async function () {
     [owner, dataWorker, liquidityProvider, refundAddress] = await ethers.getSigners();
     ({ weth, dai, l2Weth, l2Dai, hubPool, mockSpoke, timer, usdc, l2Usdc, usdt, l2Usdt } = await hubPoolFixture());

test/evm/hardhat/chain-specific-spokepools/Arbitrum_SpokePool.ts

@@ -323,4 +323,18 @@ describe("Arbitrum Spoke Pool", function () {
       ).to.be.revertedWith("OftIncorrectAmountSentLD");
     });
   });
+
+  it("Cross domain owner can set and remove an OFT messenger", async function () {
+    l2OftMessenger.token.returns(l2UsdtContract.address);
+
+    await expect(arbitrumSpokePool.setOftMessenger(l2UsdtContract.address, l2OftMessenger.address)).to.be.reverted;
+
+    await arbitrumSpokePool.connect(crossDomainAlias).setOftMessenger(l2UsdtContract.address, l2OftMessenger.address);
+    expect(await arbitrumSpokePool.oftMessengers(l2UsdtContract.address)).to.equal(l2OftMessenger.address);
+
+    await expect(arbitrumSpokePool.setOftMessenger(l2UsdtContract.address, zeroAddress)).to.be.reverted;
+
+    await arbitrumSpokePool.connect(crossDomainAlias).setOftMessenger(l2UsdtContract.address, zeroAddress);
+    expect(await arbitrumSpokePool.oftMessengers(l2UsdtContract.address)).to.equal(zeroAddress);
+  });
 });