First Flight #4: Boss Bridge

Summary

By using the create opcode to deploy new tokens we are subject to address creation based on account nonce. This means that if we were to deploy a token on both chains, that for the addresses to be equal, the account nonces should also be equal. This could lead to confusion for users expecting a certain token to share the same address on both chains.

Vulnerability Details

The deployToken function uses the create opcode to create a new token. The create opcode generates the address based on the address and nonce of the sender. Provided that the TokenFactory will be deployed on both Ethereum Mainnet and ZkSync we can assume that there will be occurrences where the owner would like to deploy a token on both chains. In order to have this token share the same address on both chains the owner would have to manage the account nonces to be equal on both chains, as well as have the owner of the TokenFactory be the same address (=> not transferring owners for either of the implementations). This introduces complexity in generating a shared address for a token on both chains.

Impact

Confusion over token addresses

Tools Used

Manual review

Recommendations

Favour the use of create2 opcode over the create opcode in order to allow the owner of the TokenFactory to create a shared address for a token on both chains. The create2 opcode allows the token deployer to specify a salt, giving the owner control over whether to create a shared-address token or not.