`ChakraSettlement::send_cross_chain_msg()` Can Be Called by Anyone, Leading to Malicious Updates in the `nonce_manager` Mapping, Potentially Causing the Program to Fail.
Audit: 2024-08-chakra-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-08-chakra/blob/abef77d95866f2fec93270491fc5abc9ab14f86d/solidity/settlement/contracts/ChakraSettlement.sol#L111-L156
https://github.com/code-423n4/2024-08-chakra/blob/abef77d95866f2fec93270491fc5abc9ab14f86d/solidity/handler/contracts/ChakraSettlementHandler.sol#L111-L223


# Vulnerability details

[Official document address](https://s3labs.notion.site/Contract-Design-Document-f4aa296f71fb40b1818c0890c40be55c#2286a74561ce4765909db58db373eaee)
Refer to the attached flowchart for a detailed explanation. Due to the complexity of the code and the steps involved, this report will focus on steps 2 and 6 of the process.

Part 1 (Corresponding to Step 2 in the Flowchart):
When the `ChakraSettlementHandler::cross_chain_erc20_settlement()` function is called to perform a cross-chain settlement, both the `ChakraSettlementHandler` and `ChakraSettlement` contracts utilize their respective `nonce_manager` mappings to generate random numbers, which are used to create a `txid`. The status of the `txid` is then updated in the `create_cross_txs[txid]` mapping to `CrossChainTxStatus.Pending`.

However, due to the absence of access restrictions in the `ChakraSettlement::send_cross_chain_msg()` function, and since `from_address` is passed as a parameter, a malicious user can arbitrarily modify the value of `nonce_manager[from_address]`. Consequently, the `txid` generated in the `ChakraSettlementHandler` and `ChakraSettlement` contracts will not match.
```js
    // ChakraSettlementHandler::cross_chain_erc20_settlement()
    function cross_chain_erc20_settlement(
        string memory to_chain,
        uint256 to_handler,
        uint256 to_token,
        uint256 to,
        uint256 amount
    ) external {

        // SNIP...

        {
            // Increment nonce for the sender
@>            nonce_manager[msg.sender] += 1;
        }


        // Create a new cross chain tx
@>        uint256 txid = uint256(
            keccak256(
                abi.encodePacked(
                    chain,
                    to_chain,
                    msg.sender, // from address for settlement to calculate txid
                    address(this), //  from handler for settlement to calculate txid
                    to_handler,
@>                    nonce_manager[msg.sender]
                )
            )
        );


        {
            // Save the cross chain tx
@>            create_cross_txs[txid] = CreatedCrossChainTx(
                txid,
                chain,
                to_chain,
                msg.sender,
                to,
                address(this),
                to_token,
                amount,
                CrossChainTxStatus.Pending
            );
        }
        {
        // SNIP...

            // Send the cross chain msg
@>            settlement.send_cross_chain_msg(
                to_chain,
                msg.sender,
                to_handler,
                PayloadType.ERC20,