Summary

The L2ContractMigrationFacet contract facilitates the migration of assets owned by contracts from Layer 1 (L1) to Layer 2 (L2) using a merkle root for verification. This report identifies a critical issue with the hardcoded merkle root (MERKLE_ROOT) used for verification in the redeemDepositsAndInternalBalances function.

Vulnerability Details

The primary issue is the hardcoded nature of MERKLE_ROOT in the contract:

Using a hardcoded merkle root limits flexibility and adaptability. It assumes a fixed state of the merkle tree and does not accommodate updates or changes to the underlying data structure (e.g., deposits, internal balances) without deploying a new contract.

Impact

If the merkle root (MERKLE_ROOT) is compromised or incorrect, it can lead to unauthorized deposits being redeemed on L2, potentially resulting in financial losses. Hardcoding the merkle root limits the contract's ability to scale or evolve with changes in deposit structures or business requirements.

Tools Used

Manual Review

Recommendations

Implement a mechanism to dynamically generate or update the merkle root based on current deposit and internal balance data. This can be achieved by computing the merkle root on-chain based on stored data or using an off-chain oracle for periodic updates.