Submission Details
Severity:
Arbitrary SafeTransfer Function in Deposit
Summary
safeTransferFrom() called in the depositTokensToL2() function allows for the passing of an arbitrary 'from' address.
Vulnerability Details
If user1 has approved token transfer to the vault contract, then other approved users can call eg.. deposit(user1, userx, 100) in order to steal tokens from user1, deposit them to the bridge and have the corresponsing L2 tokens minted on userx address.
Impact
direct stealing of funds
Tools Used
Recommendations
change the 'from' address parameter to msg.sender
Updates
Lead Judging Commences
0xnevi almost 2 years ago
Submission Judgement Published Assigned finding tags:
depositTokensToL2(): abitrary from address
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.