Submission Details
Severity:
Lack of verification of prior successful deposit
Summary
Lack of verification if the sender has first originated a successful deposit
Vulnerability Details
In L1BossBridge::withdrawTokensToL1 there is no verification process to ensure that the caller has first originated a successful deposit of an amount at least egals to the amount to be withdrawn in the L1 part of the bridge.
Impact
Anyone can withdraw tokens without first depositing any.
Tools Used
Manual review
Recommendations
Before executing withdrawal, check if the sender has previously successfully deposited a sufficient amount of tokens either in L1 or L2.
Updates
Lead Judging Commences
0xnevi almost 2 years ago
Submission Judgement Published Assigned finding tags:
withdrawTokensToL1(): No check for deposits amount
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.