Submission Details
Severity:
bridgeOverplus() does not check if msg.value is enough to cover the cost
Vulnerability Details
Fund can be lost if the L1 call value provided is insufficient to cover _maxSubmissionCost, or stuck if insufficient to cover _maxSubmissionCost + (_maxGas * _gasPriceBid).
Impact
When the call form L1 is failed, the fund is now exists in L1Sender contract and will not be re-callable as the bridgeOverplus() function required to be called from Distribution but in Distribution the overplus is already 0 as it has transferred the token in to L1Sender.sol.
Tools Used
Manual Review
Recommendations
Add check similar to the one used in L1GatewayRouter provided by Arbitrum team
uint256 expectedEth = _maxSubmissionCost + (_maxGas * _gasPriceBid);
require(_maxSubmissionCost > 0, "NO_SUBMISSION_COST");
require(msg.value == expectedEth, "WRONG_ETH_VALUE");
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.