Submission Details
Severity:
[H-1] - Initializer front-running in `L2TokenReceiver` contract
Summary
Malicious user can front-run the L2TokenReceiver__init() initializer function
Vulnerability Details
After the front-running, the user can swap unlimited amount of tokens essentially for free, before the redeployment
of the protocol
Impact
Significant tokenOut losses
Tools Used
Manual review
Recommendations
Implement valid access control on the L2TokenRecivercontract to ensure only the relevant deployer can call L2TokenReceiver__init function.
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.