First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`L1Vault` is shared between users of `L1BossBridge`

silvana

Summary

L1Vault is shared between all users of L1BossBridge

Vulnerability Details

Since there is a single instance of L1Vault within L1BossBridge that is shared by all users, it could be saturated very fast rendering the L1BossBridges depositTokensToL2 tokens unavailable.

POC:

  1. In the L1TokenBridge.t.sol add a random user in the test' state:

address random = makeAddr("random");

  1. Add following test:

function testOneUserCanSaturateVault() public {
// user deposits maximum amount in vault
vm.startPrank(user);
uint256 amount = tokenBridge.DEPOSIT_LIMIT();
deal(address(token), user, amount);
token.approve(address(tokenBridge), amount);
​
vm.expectEmit(address(tokenBridge));
emit Deposit(user, userInL2, amount);
tokenBridge.depositTokensToL2(user, userInL2, amount);
​
assertEq(token.balanceOf(address(tokenBridge)), 0);
assertEq(token.balanceOf(address(vault)), amount);
vm.stopPrank();
​
// random user can no longer use the vault
vm.startPrank(random);
amount = 1;
deal(address(token), random, amount);
token.transfer(address(user), amount);
token.approve(address(tokenBridge), amount);
​
vm.expectRevert(
L1BossBridge.L1BossBridge__DepositLimitReached.selector
);
tokenBridge.depositTokensToL2(random, userInL2, amount);
vm.stopPrank();
}

  1. Run the test -> it passes.

Impact

one user or a small group of users could saturate the L1Vault with L1Tokens up to the DEPOSIT_LIMIT amount thus rendering the L1BossBridge unavailable for other users.

Tools Used

Manual code review and automated test

Recommendations

Provide separate L1Vaults per user.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): DoS deposits via DEPOSIT_LIMIT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.