Summary

Tokens do not get approved to be spent by the Uniswap router, which will always make swap revert and lock any tokens sent to this contract in the process

Vulnerability Details

In L2TokenReciever.sol, swap() does not approve tokens to be spent by the Uniswap router. This will cause any call to swap() to always revert upon calling and will results in all tokens sent to the contract to be locked forever.

Impact

This issue will make any ERC20 tokens sent to be contract to be permanently frozen in the contract, hence the high-severity of this finding.

Tools Used

Manual Review

Recommendations

consider making the contract take the tokens out of the user upon calling so that even if something else makes the execution fail the funds will still be in the user's balance. And also consider adding approve to swapRouter before line added in relevant github link