DecentBridgeExecutor.sol#_executeWeth() - A malicious target inside ` UTBExecutor `  can send 1 wei of WETH to the DecentBridgeExecutor to force a revert
Audit: 2024-01-decent-findings
Severity: MEDIUM

# Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentBridgeExecutor.sol#L40-L41


# Vulnerability details

## Impact
The `DecentBridgeExecutor` is one of the contracts that is used on the destination chain to handle the call from LZ.

```jsx
 function execute(
        address from,
        address target,
        bool deliverEth,
        uint256 amount,
        bytes memory callPayload
    ) public onlyOwner {
        weth.transferFrom(msg.sender, address(this), amount);

        if (!gasCurrencyIsEth || !deliverEth) {
            _executeWeth(from, target, amount, callPayload);
        } else {
            _executeEth(from, target, amount, callPayload);
        }
    }
```

`execute` is called inside `DecentEthRouter`.

```jsx
function onOFTReceived(
        uint16 _srcChainId,
        bytes calldata,
        uint64,
        bytes32,
        uint _amount,
        bytes memory _payload
    ) external override onlyLzApp {
        ...
        } else {
            weth.approve(address(executor), _amount);
            executor.execute(_from, _to, deliverEth, _amount, callPayload);
        }
    }
```

The `execute` then either calls `_executeEth` or `_executeWeth`.

```jsx
function _executeWeth(
        address from,
        address target,
        uint256 amount,
        bytes memory callPayload
    ) private {
        uint256 balanceBefore = weth.balanceOf(address(this));
        weth.approve(target, amount);

        (bool success, ) = target.call(callPayload);

        if (!success) {
            weth.transfer(from, amount);
            return;
        }

        uint256 remainingAfterCall = amount -
            (balanceBefore - weth.balanceOf(address(this)));

        // refund the sender with excess WETH
        weth.transfer(from, remainingAfterCall);
    }

    function _executeEth(
        address from,
        address target,
        uint256 amount,
        bytes memory callPayload
    ) private {
        weth.withdraw(amount);
        (bool success, ) = target.call{value: amount}(callPayload);
        if (!success) {
            payable(from).transfer(amount);
        }
    }
```

The `target` here is the `DestinationBridgeAdapter.receiveFromBridge` on the destination chain.

You'll notice that `_executeWeth` implements a refund mechanism at the end of the function.

```jsx
        uint256 remainingAfterCall = amount -
            (balanceBefore - weth.balanceOf(address(this)));

        // refund the sender with excess WETH
        weth.transfer(from, remainingAfterCall);
```

The protocol assumes that `amount - (balanceBefore - wethBalanceOf(address(this)));` is going to always be a positive number.

`balanceBefore` is always going to be the value that `DecentEthRouter` approved `DecentBridgeExecutor` to spend in it's name, `msg.sender` being the `DecentEthRouter`.
```jsx
function execute(
        address from,
        address target,
        bool deliverEth,
        uint256