First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Token Transfer Vulnerability in `depositTokensToL2` Function

kevinkkien

Summary

The depositTokensToL2 function in the provided Solidity code lacks a check for the existence of sufficient tokens at the specified from address before initiating the transfer. This omission may lead to a vulnerability where tokens are transferred without verifying the availability of the required amount, potentially causing unintended behavior.

Vulnerability Details

The vulnerability lies in the absence of a check for the existence of sufficient tokens at the from address before executing the safeTransferFrom function. The code assumes that the from address holds the required amount of tokens, making it susceptible to a potential exploit if the balance is insufficient.

SafeERC20.sol

function safeTransferFrom(IERC20 token, address from, address to, uint256 value) internal {
_callOptionalReturn(token, abi.encodeCall(token.transferFrom, (from, to, value)));
}

L1BossBridge.sol

function depositTokensToL2(address from, address l2Recipient, uint256 amount) external whenNotPaused {
if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}
token.safeTransferFrom(from, address(vault), amount);
​
// Our off-chain service picks up this event and mints the corresponding tokens on L2
emit Deposit(from, l2Recipient, amount);
}

Impact

they could manipulate the from address to initiate token transfers without having the required balance. This may result in unintended consequences, such as failed transactions or disruptions in the functioning of the contract.

Tools Used

Manual

Recommendations

To address this vulnerability, it is recommended to implement a check for the existence of sufficient tokens at the from address before executing the safeTransferFrom function. This can be achieved by using the balanceOf function provided by the token contract. Below is an updated version of the code:

function depositTokensToL2(address from, address l2Recipient, uint256 amount) external whenNotPaused {
// Check for the existence of sufficient tokens at the 'from' address
if (token.balanceOf(from) < amount) {
revert L1BossBridge__InsufficientBalance();
}
​
// Check the token balance of the vault before transferring
if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}
​
// Transfer tokens from 'from' to 'vault'
token.safeTransferFrom(from, address(vault), amount);
​
// Off-chain service processes this event to mint corresponding tokens on L2
emit Deposit(from, l2Recipient, amount);
}
​
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.