First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Infinite Token Creation on L2 in L1BossBridge

n0kto

Summary

The depositTokensToL2 function in the smart contract allows an attacker to create an infinite number of tokens on the L2 network by exploiting the event emission mechanism. By manipulating the from address and emitting the Deposit event multiple times, the attacker can mint an unlimited amount of tokens on the L2 network.

Vulnerability Details

The vulnerability arises from the fact that the depositTokensToL2 function does not perform proper checks on the from address. An attacker can pass the address of the vault as the from parameter and emit the Deposit event multiple times, causing the L2 contract to mint tokens for the attacker. This can lead to an infinite supply of tokens for the attacker on the L2 network.

Foundry (put in test file) PoC:

function testCreateInfiniteL2TokenPoC() public {
// user send money to the bridge
testUserCanDepositTokens();
​
// withdraw to the operator address (steal user's money)
vm.startPrank(attacker);
​
// Create infinite event (and token on L2 for the attacker)
for (uint i; i < 3; i++) {
vm.expectEmit(address(tokenBridge));
emit Deposit(address(vault), attackerInL2, 10e18);
tokenBridge.depositTokensToL2(address(vault), attackerInL2, 10e18);
}
​
vm.stopPrank();
}

Impact

By exploiting this vulnerability, an attacker can create an unlimited number of tokens on the L2 network, potentially leading to inflation and devaluation of the token. This can result in financial loss and undermine the integrity of the token system.

Tools Used

Manual review

Recommendations

To mitigate this vulnerability, it is recommended to remove the from parameter in depositTokensToL2 function. Use instead msg.sender in all places from argument is used.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): abitrary from address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.