First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

An attacker may cause Dos of the contract by repeatedly calling the function `depositTokensToL2`

Y403L

Summary

Since depositTokensToL2 does not limit the size of amount, nor does it limit the frequency of calls, in the event that Bridge Owner does not suspend the bridge in time, an attacker may cause Dos by depositing only 1 wei at a time and calling the function repeatedly.

Vulnerability Details

An attacker can deposit only 1 wei at a time and call the function repeatedly, resulting in Dos.
Change uint256 amount = 10e18; to uint256 amount = 1; in L1TokenBridge.t.sol, then run the test using forge test --match-test testUserCanDepositTokens -vvvv.

Running 1 test for test/L1TokenBridge.t.sol:L1BossBridgeTest
[PASS] testUserCanDepositTokens() (gas: 71527)
Traces:
[73142] L1BossBridgeTest::testUserCanDepositTokens()
├─ [0] VM::startPrank(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D])
│ └─ ← ()
├─ [24739] L1Token::approve(L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264], 1)
│ ├─ emit Approval(owner: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], spender: L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264], value: 1)
│ └─ ← true
├─ [0] VM::expectEmit(L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264])
│ └─ ← ()
├─ emit Deposit(from: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], to: userInL2: [0x7e8cC97F47B22E28B1092403d7DA1Bd51D9d6aDb], amount: 1)
├─ [31824] L1BossBridge::depositTokensToL2(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], userInL2: [0x7e8cC97F47B22E28B1092403d7DA1Bd51D9d6aDb], 1)
│ ├─ [2562] L1Token::balanceOf(L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7]) [staticcall]
│ │ └─ ← 0
│ ├─ [23090] L1Token::transferFrom(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], 1)
│ │ ├─ emit Transfer(from: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], to: L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], value: 1)
│ │ └─ ← true
│ ├─ emit Deposit(from: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], to: userInL2: [0x7e8cC97F47B22E28B1092403d7DA1Bd51D9d6aDb], amount: 1)
│ └─ ← ()
├─ [2562] L1Token::balanceOf(L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264]) [staticcall]
│ └─ ← 0
├─ [562] L1Token::balanceOf(L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7]) [staticcall]
│ └─ ← 1
├─ [0] VM::stopPrank()
│ └─ ← ()
└─ ← ()
​
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.03ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Impact

There's some level of disruption to the protocol's functionality or availability.

Tools Used

Foundry

Recommendations

  • set MIN_DEPOSIT

  • Limit call frequency

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): DoS deposits via DEPOSIT_LIMIT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.