L2EthToken.withdraw can be underflow with little cost

Lines of code Vulnerability details Impact calculating balanceaddressthis within unchecked will cause underflow. Say if balanceaddressthis == 1 and msg.value == 2, after calling withdraw, balanceaddressthis will be typeuint256.max Proof of Concept function underFlowuint a, uint b public pure...

L2EthToken.sol balance[address(this)] COULD UNDERFLOW

Lines of code Vulnerability details Impact The ethereum balance of the L2EthToken.sol contract can underflow thus breaking the accounting of the protocol for L2-L1 fund transfers. Proof of Concept L2EthToken.sol contract has the withdraw function to transfer funds to L1 for withdrawal. In the...

Malicious or hacked admin can steal all ETH

Lines of code Vulnerability details Impact In L2EthToken.sol we have transferFromTo It is possible malicious or hacked admin to steal the ETH. Proof of Concept As can be seen from the code snippet below, nothing can stop malicious or hacked admin to steal all ETH. He can use address from and send...

Possible loss of funds when withdrawing from L2 to L1

Lines of code Vulnerability details Impact Context To initiate a withdrawal from L2 to L1, a user can call L2EthToken.withdraw method, then funds will be available to calim on L1 via finalizeEthWithdrawal method of MailboxFacet. function withdrawaddress l1Receiver external payable override The...