Summary

The use_withdraw_auto flag in the deposit_tokens function of the L2 Bridge.cairo contract is intended to automate the withdrawal of tokens on L1. However, the corresponding functionality is disabled on the L1 contract, leading to a situation where tokens may be locked on L2 without any clear mechanism for retrieval.

Vulnerability Details

In the deposit_tokens function on L2, users can set the use_withdraw_auto flag to true, which signals that the withdrawal of tokens on L1 should be handled automatically. The code snippet for the flag is shown below:

However, in the withdrawTokens function on the L1 Bridge.sol contract, the auto-withdrawal functionality has been explicitly disabled:

The L1 contract reverts with a NotSupportedYetError when the use_withdraw_auto flag is set to true, effectively disabling the automatic withdrawal process. This means that any tokens intended for automatic withdrawal will remain in escrow on L2 indefinitely, as there is no fallback mechanism to handle these tokens manually.

Impact

Tokens that were intended to be withdrawn automatically on L1 may become permanently locked in the L2 escrow if the use_withdraw_auto flag is set to true. Users who expect their tokens to be automatically withdrawn may be unaware that this functionality is not supported, leading to frustration and potential loss of funds. The only way to recover is by a upgrade to Bridge contract on L2.

Tools Used

Manual Review.

Recommendations

Disable** use_withdraw_auto on L2. **Modify the deposit_tokens function to reject transactions where use_withdraw_auto is set to true. This will prevent users from mistakenly enabling a feature that is not supported on L1.