lidofinance / lido-l2

GNU General Public License v3.0
30 stars 38 forks source link

L2 bridge missing EOA check for withdraw #53

Open TheDZhon opened 1 year ago

TheDZhon commented 1 year ago

Optimism standard L2 token bridge (onlyEOA modifier):

function withdraw(
    address _l2Token,
    uint256 _amount,
    uint32 _minGasLimit,
    bytes calldata _extraData
) external payable virtual onlyEOA {
    _initiateWithdrawal(_l2Token, msg.sender, msg.sender, _amount, _minGasLimit, _extraData);
}

For the wstETH version, this check is missing:

function withdraw(
    address l2Token_,
    uint256 amount_,
    uint32 l1Gas_,
    bytes calldata data_
) external whenWithdrawalsEnabled onlySupportedL2Token(l2Token_) {
    _initiateWithdrawal(msg.sender, msg.sender, amount_, l1Gas_, data_);
}

However, it should have been there due to known design decision of Optimism.