User can send an excess of ETH to L1GraphTokenGateway

Lines of code Vulnerability details Impact User can send too much ether into the contract which may get stuck if there is issues with the refund process. Proof of Concept User sends too much ether to outboundTransfer. This is sent to a refund address in Arbitrum. If Arbitrum is compromised or suc...

If L1GraphTokenGateway's outboundTransfer is called by a contract, the entire msg.value is blackholed, whether the ticket got redeemed or not.

Lines of code Vulnerability details The outboundTransfer function in L1GraphTokenGateway is used to transfer user's Graph tokens to L2. To do that it eventually calls the standard Arbitrum Inbox's createRetryableTicket. The issue is that it passes caller's address in the submissionRefundAddress a...

UNSAFE USAGE OF ERC20 TRANSFERFROM

Lines of code Vulnerability details Impact Ignores return value from L1GraphTokenGateway.finalizeInboundTransfer and L1GraphTokenGateway.outboundTransfer Not tracking values returned by token transfer from. finalizeInboundTransfer When escrow not approve for L1GraphTokenGateway or allowance is no...

Ignores return value from L1GraphTokenGateway.outboundTransfer

Lines of code Vulnerability details Impact Not tracking values returned by token transfer from. So from was getted from parseOutboundData, and if encoded data is wrong, this can return not expected from address. Then from will passed into transferFrom and it not approve for escrow or allowance is...

The L1GraphTokenGateway does not work on non-standard compliant tokens like USDT

Lines of code Vulnerability details Vulnerability details The L1GraphTokenGateway function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that don't return a return value. However, this does not work as...