Bridge::withdrawTokens is payable
Summary
Bridge::withdrawTokens is left payable and can mistakenly cause users to send native assets when consuming their L2 messages, which will lead to loss of funds since there is no function to retrieve mistakenly sent funds.
Vulnerability Details
But actually, there is no need to provide any tokens while consuming the message from L2.
Impact
Loss of funds for the users that provide a native asset to the Bridge::withdrawTokens.
Tools Used
Manual Review
Recommendations
Remove the payable keyword from the function:
Lead Judging Commences
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Appeal created
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.