Era
ZKsync
FoundryLayer 2
500,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

L2AssetRouter::_ensureTokenRegisteredWithNTV will always return zero, as assetId variable is never updated inside the function

crunter

Summary

L2AssetRouter::_ensureTokenRegisteredWithNTV function is supposed to return the asset Id of the registered token. However, this value is never set and the function is always returning a default bytes32 value.

Vulnerability Details

L2AssetRouter::_ensureTokenRegisteredWithNTV function is used to get the asset Id corresponding to the token address passed as argument. However, even when the function actually perform some calculations, the returned assetId variable is never updated. This results in an incorrect return value, causing processes that rely on this data to fail.

L2AsserRouter.sol
​
function _ensureTokenRegisteredWithNTV(address _token) internal override returns (bytes32 assetId) {
// @audit - assetId is never updated!
IL2NativeTokenVault nativeTokenVault = IL2NativeTokenVault(L2_NATIVE_TOKEN_VAULT_ADDR);
nativeTokenVault.ensureTokenIsRegistered(_token);
}
​

Impact

Impact: High

Functions that depend on the return value of L2AssetRouter::_ensureTokenRegisteredWithNTV will always fail.

Likelihood: Medium

Tools Used

Manual Review

Recommendations

Update the assetId variable after perform the calculations within the function.

L2AsserRouter.sol
​
function _ensureTokenRegisteredWithNTV(address _token) internal override returns (bytes32 assetId) {
IL2NativeTokenVault nativeTokenVault = IL2NativeTokenVault(L2_NATIVE_TOKEN_VAULT_ADDR);
- nativeTokenVault.ensureTokenIsRegistered(_token);
+ assetId = nativeTokenVault.ensureTokenIsRegistered(_token);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`L2AssetRouter._ensureTokenRegisteredWithNTV` `assetId` return value is never assigned, which will cause `withdrawToken` to fail

Appeal created

inallhonesty Lead Judge
5 months ago
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`L2AssetRouter._ensureTokenRegisteredWithNTV` `assetId` return value is never assigned, which will cause `withdrawToken` to fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.