Summary

A mismatch in encoding formats for assetId occurs when setting the assetHandlerAddress in L2AssetRouter::_setAssetHandlerAddressThisChain and reading it during withdrawal operations in L2AssetRouter. The inconsistency prevents successful lookups of the assetHandlerAddress mapping, causing withdrawals to revert and leading to poor user experience and potential financial losses.

Vulnerability Details

Setting the assetHandlerAddress

When L2AssetRouter::setAssetHandlerAddressThisChain is called, it updates the assetHandlerAddress mapping via the AssetRouterBase::_setAssetHandlerAddressThisChain function. The assetId is calculated using DataEncoding::encodeAssetId, which encodes the chain ID, sender address, and asset data as follows:

Code Reference

_setAssetHandlerAddressThisChain:

Note that, this is the primary point of update for assetHandlerAddress mapping in L2AssetRouter.
The other points of update are:

• The constructor : where the asset handler for only the base token is set.

• setAssetHandlerAddress : which can only be set by the counterpart L1AssetRouter.

• _finalizeDeposit : which strictly sets the asset handler for only the L2_NATIVE_TOKEN_VAULT_ADDR.

Reading the assetHandlerAddress During Withdrawals

When L2AssetRouter::withdrawToken or legacy withdrawal functions are invoked, a different encoding method is used to calculate the assetId. For example, the _withdrawLegacy function generates the assetId using DataEncoding::encodeNTVAssetId:

Inconsistency in Encoding Formats

• Setting: encodeAssetId includes the sender address in the encoding.

• Reading: encodeNTVAssetId uses a hardcoded L2_NATIVE_TOKEN_VAULT_ADDR

The mismatch ensures that the assetId generated during withdrawal will never match the one used to set the assetHandlerAddress, leading to failed lookups.

Impact

The causes users withdrawal transactions to consistently revert until an admin intercedes to resolve the issue through setAssetHandlerAddress which is called from the L1. Not only is this a poor user experience, it's inefficient, and obviously unfeasable. Admins can't step in everytime a user wants to withdraw their tokens from the L2. This could also lead to financial loss for users.

Tools Used

Manual code review.

Recommendations

To address the issue, the same encoding function should be used across all operations involving assetId. This ensures consistent behavior when setting and reading the assetHandlerAddress.