Summary

There is no way to recover NFTs if a l2 to l1 request reverts. This can happen due to mistakes when creating the request on l2. Another situation where this can happen is if features are enabled/disabled in Bridge.sol or the contract is upgraded.

Vulnerability Details

The function withdrawTokens in Bridge.sol can revert for many reasons, in this scenario the user is unable to recover their NFT until the request becomes valid.

Impact

NFTs become stuck for an indefinite amount of time.

Tools Used

Manual Review

Recommendations

Introduce a way to cancel requests from l2 to l1 similar to how it works for l1 to l2 requests.