Summary

On-chain NFT collections store their image on-chain instead of using IPFS or similar. They often have very large tokenURI's, the length of which can vary massively between tokens within a collection. Due to the payload length limit many/all tokens from an on-chain collection will be unable to be bridged.

Vulnerability Details

The Payload length limit found in the function depositTokens in Bridge.sol ensures the length of the payload is less than 300. Many on-chain NFT collections will easiely exceed this limit with just a single token.

Impact

Some/ all tokens from a collection are unable to be bridged

Tools Used

Manual Review

Recommendations

Give the option to ignore the tokenURI on l1 then manually set it on l2