Submission Details
Severity:
Missing Zero Address Validation
Summary
Address target in L1BossBridge#sendToL1() could be zero address.
Vulnerability Details
Value of address target in L1BossBridge#sendToL1() could be zero address and call() method returns True if account called is non-existent. If the message input is not correct, the call to L1BossBridge#sendToL1() will not revert.
(address target, uint256 value, bytes memory data) = abi.decode(message, (address, uint256, bytes));
(bool success,) = target.call{ value: value }(data);
if (!success) {
revert L1BossBridge__CallFailed();
}
Impact
The call to L1BossBridge#sendToL1() will not revert, but the token still not be sent to L1 blockchain successfully, lead to waste of transaction fee.
Tools Used
Manual review.
Recommendations
Add require condition to check for zero address after line 119 of L1BossBridge.sol contract as below:
require(target != address(0), "Invalid address");
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.