60,000 USDC
Submission Details
Severity:
The function `withdraw_auto_from_l1` lacks a check on `req`, allowing an attacker to forge `req`.
Summary
The function withdraw_auto_from_l1 lacks a check on req, allowing an attacker to forge req.
Vulnerability Details
The function withdraw_auto_from_l1 is used to withdraw tokens from L1. The parameter req contains all the key information, such as address, token ids, etc. However, the function does not check whether req is valid. This allows attackers to forge req and steal tokens.
Impact
Attackers can forge request to steal tokens.
Tools Used
Vscode
Recommendations
Check the validity of req.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126
USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.