First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`L1BossBridge::DEPOSIT_LIMIT` check creates DoS attack

wafflemakr

Summary

L1BossBridge::DEPOSIT_LIMIT will make any deposit revert if an attacker sends DEPOSIT_LIMIT + supplyL2 + 1 tokens directly to vault contract.

Vulnerability Details

Attacker can manually send DEPOSIT_LIMIT + 1 amount of ERC20 tokens directly to the vault contract, creating a DoS to L1BossBridge::depositTokensToL2, because of this check:

if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}

Any deposit transaction from user will revert. As long as there are no tokens on L2, ready to be sent to L1, token.balanceOf(address(vault)) will not change.

Alternatively, attacker can just send DEPOSIT_LIMIT + supplyL2 + 1 ERC20 tokens directly to the vault contract to make all deposits fail. supplyL2 amount is added here to make sure that users when withdrawing funds from L2 to L1, vault balance will decrease, but not enough to remove the DoS

Impact

High. Denial of Service breaks the protocol main purpose of bridging funds from L1 to L2.

Tools Used

  • Manual Review

Recommendations

Consider keeping track of the actual deposits made from users, when calling L1BossBridge::depositTokensToL2, to make the validation check, instead of the balance of the vault

function depositTokensToL2(address from, address l2Recipient, uint256 amount) external whenNotPaused {
- if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
+ if (totalDeposits) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}
token.safeTransferFrom(from, address(vault), amount);
​
// Our off-chain service picks up this event and mints the corresponding tokens on L2
emit Deposit(from, l2Recipient, amount);
}
Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): DoS deposits via DEPOSIT_LIMIT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.