60,000 USDC
Submission Details
Severity:
No zero address check in `deposit_tokens` in L2 bridge contract
Summary
owner_l1 is not being checked for zero address in deposit_tokens function
Vulnerability Details
No validation is performed if owner_l1 is zero address. If user accidentally sets the owner_l1 to zero address, the message can never be consumed on L1 bridge resulting NFts loss
Impact
Loss of NFTs
Tools Used
Manual review
Recommendations
Revert if onwer_l1 is zero address
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.