MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

ERC20 tokens will be stuck in `GatewayRouterMock` since there is no way to withdraw them and they are not approved/transferred anywhere from it.

0x11singh99

Vulnerability Details

L1Sender approved erc20 token _newToken in _replaceDepositTokenGateway at line 95. _newToken is wstEth according to protocol. And when
GatewayRouterMock::outboundTransfer is called in L1Sender::sendDepositToken function. In outboundTransfer function
wstEth _token is transferred from it's caller L1Sender. Since L1Sender already approve this contract so they will be transferred. But after coming here they are neither transfer to it's receiver nor their is anyway to withdraw them from GatewayRouterMock contract so those tokens will be stuck here forever.

Code Snippet

contracts/mock/GatewayRouterMock.sol#L6-L18

6: contract GatewayRouterMock {
function outboundTransfer(
address _token,
address _to,
uint256 _amount,
uint256 _maxGas,
uint256 _gasPriceBid,
bytes calldata _data
) external payable returns (bytes memory) {
IERC20(_token).transferFrom(msg.sender, _to, _amount);//@audit token transferred to this contract
​
return abi.encode(_token, _to, _amount, _maxGas, _gasPriceBid, _data);
}

contracts/L1Sender.sol#L114-L121

114: IGatewayRouter(config.gateway).outboundTransfer{value: msg.value}(
config.token,
config.receiver,
amount_,
gasLimit_,
maxFeePerGas_,
data_
);

/main/contracts/L1Sender.sol#L95

95: IERC20(newToken_).approve(IGatewayRouter(newGateway_).getGateway(newToken_), type(uint256).max);

Impact

wstEth tokens or any erc20 token approved to GatewayRouterMock by L1Sender will be stuck in GatewayRouterMock contract. There is no way to withdraw them neither GatewayRouterMock is approving to anyone nor tokens will not be sent to it's passed receiver.

Tools Used

Manual Review

Recommended Mitigation

Transfer/approve the erc20 tokens to it's receiver for that they are coming. And also add a withdraw function controlled by owner in the contract GatewayRouterMock so he can withdraw stuck erc20 tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

GatewayRouterMock lacks some functionality

0x11singh99 Submitter
over 1 year ago
inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.