You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The text was updated successfully, but these errors were encountered:
sherlock-admin4
changed the title
Joyous Steel Wren - Improper initialization of L1StandardBridge will disable bridging ETH until at least one other asset is bridged
speedy78214 - Improper initialization of L1StandardBridge will disable bridging ETH until at least one other asset is bridged
Oct 12, 2024
speedy78214
Medium
Improper initialization of
L1StandardBridge
will disable bridgingETH
until at least one other asset is bridgedSummary
Improper initialization of
L1StandardBridge
will result in failure of bridging ETH asmessenger
is not properly instantiatedRoot Cause
L1StandardBridge.sol: 112
,initialize
function is called with_messenger
asCrossDomainMessenger(address(0))
.L1StandardBridge.sol: 145
, ETH transfer results in ETH bridge initiation by calling_initiateBridgeETH
._initiateBridgeETH
function, ETH bridge is initiated by sending message usingmessenger.sendMessage
(L1StandardBridge.sol: 249
)CrossDomainMessenger.sol:181
,sendMessage
function will call_sendMessage
, which is a virtual function (CrossDomainMessenger.sol:382
).messenger
is not initialized as aL1CrossDomainMessenger
with constructor,sendMessage
will eventually failsInternal pre-conditions
L1StandardBridge
External pre-conditions
No response
Attack Path
L1StandardBridge
is deployed and instantiatedEOA
s transfer ETH to bridge viaL1StandardBridge
.L1StandardBridge
Impact
The users will not able to bridge ETH until other assets are not bridged
PoC
Add the following test case to
tokamak-thanos/packages/tokamak/contracts-bedrock/test/L1/L1StandardBridge.t.sol:L1StandardBridge_Receive_Test
.Mitigation
Inside
L1StandardBridge.sol:_initiateBridgeETH
,L1CrossDomainMessenger(address(messenger)).sendMessage
should be used instead ofmessenger.sendMessage
The text was updated successfully, but these errors were encountered: