search

tokamak-network / tokamak-thanos

MIT License
7 stars 3 forks source link

Inappropriate implementation of _initiateBridgeETH in L1standardBridge #223

Closed mehdi-defiesta closed 3 weeks ago

mehdi-defiesta commented 3 weeks ago

Describe the bug users are able to send ETH to L1StandardBridge. these funds are catched by the receive function which will call _initiateBridgeETH function. _initiateBridgeETH function encodes the message to be sent to L2 and the user might end up having ETH on L2 (which is not what we want on Thanos ?)

Configuration

Impact Unwanted ETH sent to Thanos

Recommendation removing the receive function.

Exploit Scenario

Demo

nguyenzung commented 3 weeks ago

Thank you @mehdi-defiesta

This behavior is expected. We allow depositing ETH on L1 and receive a kind of WETH on L2 (We still call it ETH on L2)