Usage of `_token.approve` and `success` check on `L1ERC20Bridge` will revert for tokens that do not return a boolean value on approval
Summary
The _approveFundsToAssetRouter from L1ERC20Bridge.sol function uses _token.approve and checks the success value. This approach will revert for tokens that do not return a boolean value on approval.
Vulnerability Details
Some ERC20 tokens do not return a boolean value on the approve function, such as USDT. The current implementation of L1ERC20Bridge assumes that the approve function will always return a boolean value, which can lead to unexpected reverts.
Impact
The function will revert for tokens that do not return a boolean value on the approve function, causing a denial of service in L1ERC20Bridge.deposit for those tokens.
Tools Used
Manual review.
Recommendations
Use SafeERC20.forceApprove from OpenZeppelin to correctly handle tokens that do not return boolean values on approve.
Lead Judging Commences
`L1ERC20Bridge` Uses Unsafe Approvals - USDT won't work
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.