First Flight #4: Boss Bridge

Summary

The token symbol passed in to TokenFactory's deploy() function is not representative of the actual symbol of the token.

Vulnerability Details

TokenFactory's deploy() function is deploying an arbitrary contract at an address using create. After that it is setting the symbol of the supposed deployed "token" to the address of the deployed contract.

Assuming this will be a L1Token, the actual symbol of the token is hardcoded to BBT in it's constructor. Meaning it cannot be altered.

This can be the cause of confusion when checking for the address of the token using the TokenFactory smart contract. The only way to get the address of the token through TokenFactory is getTokenAddressFromSymbol() function, which retrieves the value from a mapping. Meaning that passing in BBT as the symbol of the token may not be representative of the actual symbol stored in the mapping.

Impact

This won't cause any breaking errors in the protocol, but can be the cause of confusion.

Tools Used

Manual Review

Recommendations

Either pass in the same token symbol as the deployed contract, or better to avoid collisions in the map instead of token symbol, pass in something like a unique deployedTokenIdentifier that would be unique to each token and avoid confusion altogether.