howlbot-integration[bot] commented 1 month ago

Lines of code

https://github.com/code-423n4/2024-05-arbitrum-foundation/blob/6f861c85b281a29f04daacfe17a2099d7dad5f8f/src/rollup/RollupUserLogic.sol#L82-L89

Vulnerability details

Description

One of the assertions is:

- Honest assertions / layer zero edges are always confirmed under the BoLD paper’s assumptions within 2 challenge periods.
    - plus the security council grace period for assertions

As per the BoLD paper, honest assertions should be confirmed at most ~14 days. However, it is possible to pause the ability to confirm assertions by calling RollupAdminLogic.pause()

    function pause() external override {
        _pause();
        emit OwnerFunctionCalled(3);
    }

If this function gets called, any call made to RollupUserLogic.confirmAssertion() will fail due to the modifier whenNotPaused:

    function confirmAssertion(
        bytes32 assertionHash,
        bytes32 prevAssertionHash,
        AssertionState calldata confirmState,
        bytes32 winningEdgeId,
        ConfigData calldata prevConfig,
        bytes32 inboxAcc
->  ) external onlyValidator whenNotPaused {

This means that there are scenario's possible where an assertion will take longer than the ~14 days described in the BoLD paper, thus breaking this main invariant.

Tools used

Manual Review

Recommended Mitigation Steps

Let the time run during a pause() to stop it from breaking the main invariant.