Era
ZKsync
FoundryLayer 2
500,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

L1 Chain doesn't support deposits that revert on 0 approval like BNB

holydevoti0n

Vulnerability Details

Some tokens can revert when 0 approvalis set. The popular BNB is one of them:

https://etherscan.io/token/0xB8c77482e45F1F44dE1745F52C74426C631bDD52#code

function approve(address _spender, uint256 _value) returns (bool success) {
@> if (_value <= 0) throw;
allowance[msg.sender][_spender] = _value;
return true;
}

The problem is that L1ERC20Bridgecalls approve with 0for all tokens.

https://github.com/Cyfrin/2024-10-zksync/blob/cfc1251de29379a9548eeff1eea3c78267288356/era-contracts/l1-contracts/contracts/bridge/L1ERC20Bridge.sol#L207

function deposit(
address _l2Receiver,
address _l1Token,
uint256 _amount,
uint256 _l2TxGasLimit,
uint256 _l2TxGasPerPubdataByte,
address _refundRecipient
) public payable nonReentrant returns (bytes32 l2TxHash) {
...
uint256 amount = _approveFundsToAssetRouter(msg.sender, IERC20(_l1Token), _amount);
if (amount != _amount) {
// The token has non-standard transfer logic
revert TokensWithFeesNotSupported();
}
​
​
l2TxHash = L1_ASSET_ROUTER.depositLegacyErc20Bridge{value: msg.value}({
_originalCaller: msg.sender,
_l2Receiver: _l2Receiver,
_l1Token: _l1Token,
_amount: _amount,
_l2TxGasLimit: _l2TxGasLimit,
_l2TxGasPerPubdataByte: _l2TxGasPerPubdataByte,
_refundRecipient: _refundRecipient
});
// clearing approval
//@audit-issue resetting the approval would never work for these tokens
@> bool success = IERC20(_l1Token).approve(address(L1_ASSET_ROUTER), 0);
if (!success) {
revert ApprovalFailed();
}
depositAmount[msg.sender][_l1Token][l2TxHash] = _amount;
...
}

Impact

  • DoS for tokens that revert on 0 approval. Protocol cannot receive deposits from such tokens.

Tools Used

Manual Review

Recommendations

Call forceApprove inside a try-catch block. If the call reverts, check whether the token has allowance == 0 for the L1_ASSET_ROUTER, if so, allow the code to continue, otherwise revert.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Tokens that revert on 0 approval.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.