First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`L1BossBridge:: depositTokensToL2` lack of internal accounting for deposit which makes `depositTokensTol2` unusable before actual Limit

abhishekthakur

Summary

Lack of internal accounting for deposits can cause DOS for legitimate users.

Vulnerability Details

In depositTokensToL2 function, contract check following statement.

if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}

If a user accidently sent tokens worth DEPOSIT_LIMIT or an attacker does that. Then other users won't be able to use the bridge and Tokens will be stucked there forever. This make whole system at Denial of Service state.

Impact

Users won't be able to use bridge

Tools Used

Manual review

Recommendations

Have internal accounting for deposits (and update that regularly when user deposit or withdraw). A uint256 totalDeposit should work fine.
Add a function to claim extra tokens, if accidently sent by someone. Owner should be able to claim that.

Updates

Lead Judging Commences

0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): DoS deposits via DEPOSIT_LIMIT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!