Era

Summary:

The _parseL2WithdrawalMessage(L1Nullifier.sol) function incorrectly validates the length of the message when handling the IAssetRouterBase.finalizeDeposit.selector condition. The function expects the data to be at least 68 bytes to parse successfully, but the length check currently only ensures a minimum of 36 bytes. This discrepancy may lead to unsafe reads and potential memory errors.
https://github.com/matter-labs/era-contracts/blob/9d0ffa4e846519e010329c58fb86e6f99d5e84ca/l1-contracts/contracts/bridge/L1Nullifier.sol#L608

Vulnerability Details:

The issue lies in the length check condition for the IAssetRouterBase.finalizeDeposit.selector:

• The function includes the line:

  if (_l2ToL1message.length < 36) {

  revert WrongMsgLength(36, _l2ToL1message.length);

  }

• However, to read functionSignature, uint256 originChainId, and bytes32 assetId, the _l2ToL1message needs to be at least 68 bytes long:

  • 4 bytes for functionSignature

  • 32 bytes for originChainId

  • 32 bytes for assetId

• The existing check (< 36) is insufficient and could result in an out-of-bounds memory access during parsing, leading to potential vulnerabilities or unexpected behavior.

Impact:

If the length of _l2ToL1message is less than 68 but greater than 36, the current length check passes, allowing the function to proceed with reading fields from the message. However, this can result in an unknown error or undefined behavior when the function attempts to access memory beyond the available bytes. This gap in validation can make it difficult to identify the underlying issue, as the function could revert due to out-of-bounds reads without a clear diagnostic. The revert WrongMsgLength(36, _l2ToL1message.length) error only accounts for cases where the length is under 36, leading to potential confusion and debugging challenges when the message length falls within the 36-67 range.

Tools Used:

Recommendations:

Update the length check condition for the IAssetRouterBase.finalizeDeposit.selector to ensure the _l2ToL1message is at least 68 bytes long:

This ensures that the function reads functionSignature, originChainId, and assetId safely without risking memory access errors.