First Flight #4: Boss Bridge

Summary

This issue pertains to a potential discrepancy that may arise if users send tokens directly to the vault instead of utilizing the depositTokensToL2 function in the L1BossBridge.sol contract.

Vulnerability Details

Upon manual review and employing tools such as 4nalizer and Slither, it was observed that sending tokens directly to the vault, bypassing the depositTokensToL2 function in the L1BossBridge.sol contract, can lead to a mismatch between the amounts that users bridge to other networks and the actual funds present in the vault.

Here's the relevant context from the code:

Impact

The impact of this issue is considered low as it does not directly jeopardize the funds. However, it may result in a misunderstanding between the bridged funds and the actual funds present in the vault.

Tools Used

• Manual Review

• 4nalizer

• Slither

Recommendations

To address this issue, it is recommended to introduce a variable in the L1BossBridge.sol contract that tracks the current balance in the vault, specifically the balance deposited using the depositTokensToL2 function. This variable can then be used in limit validations. Additionally, making the deposit limit customizable, rather than a constant, could enhance flexibility and accommodate varying use cases. This modification would provide more clarity and accuracy in monitoring the funds bridged through the designated function.