Submission Details
Severity:
WrappedTokenBridge#recoverTokens will drain the whole token balance
Summary
recoverTokens is supposed to retrieve tokens accidentally sent to the contract. However, if this function is called to recover the bridge's token, wrappedToken, or LINK, it will drain the whole balance of the contract, instead of just the amount that was sent by mistake.
Impact
Bridge's token balance would be drained.
Recommendations
Either add the amount to recover as a function parameter, or disable recovery of these tokens.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.