speedy78214 - Improper initialization of L1StandardBridge will disable bridging ETH until at least one other asset is bridged

[sherlock-admin3]

speedy78214

Medium

Improper initialization of L1StandardBridge will disable bridging ETH until at least one other asset is bridged

Summary

Improper initialization of L1StandardBridge will result in failure of bridging ETH as messenger is not properly instantiated

Root Cause

• In L1StandardBridge.sol: 112, initialize function is called with _messenger as CrossDomainMessenger(address(0)).
• In L1StandardBridge.sol: 145, ETH transfer results in ETH bridge initiation by calling _initiateBridgeETH.
• In _initiateBridgeETH function, ETH bridge is initiated by sending message using messenger.sendMessage(L1StandardBridge.sol: 249)
• In CrossDomainMessenger.sol:181, sendMessage function will call _sendMessage, which is a virtual function (CrossDomainMessenger.sol:382).
• As messenger is not initialized as a L1CrossDomainMessenger with constructor, sendMessage will eventually fails

Internal pre-conditions

• It will fail when other assets are not bridged via L1StandardBridge

External pre-conditions

No response

Attack Path

1. L1StandardBridge is deployed and instantiated
2. EOAs transfer ETH to bridge via L1StandardBridge.
3. It will fails until other EOA bridged non-ETH asset using L1StandardBridge

Impact

The users will not able to bridge ETH until other assets are not bridged

PoC

Add the following test case to tokamak-thanos/packages/tokamak/contracts-bedrock/test/L1/L1StandardBridge.t.sol:L1StandardBridge_Receive_Test.

function test_deposit_eth_after_constructor() external virtual {
    L1StandardBridge impl = L1StandardBridge(deploy.mustGetAddress("L1StandardBridge"));
    (address alice, ) = makeAddrAndKey("alice");
    vm.deal(alice, 1 ether);
    vm.startPrank(alice);
    (bool success,) = address(impl).call{ value: 0.1 ether }(hex"");
    assertEq(success, true);
    vm.stopPrank();
}

Mitigation

Inside L1StandardBridge.sol:_initiateBridgeETH, L1CrossDomainMessenger(address(messenger)).sendMessage should be used instead of messenger.sendMessage

function _initiateBridgeETH(
        address _from,
        address _to,
        uint256 _amount,
        uint32 _minGasLimit,
        bytes memory _extraData
)
        internal
        override
{
...
- messenger.sendMessage(
+  L1CrossDomainMessenger(address(messenger)).sendMessage(
}