Skip to content

Issues: sherlock-audit/2024-08-tokamak-network-judging

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

83 Open 7 Closed
83 Open 7 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Remove require statement for calling paused in L2StandardBridge Sponsor Confirmed The sponsor acknowledged this issue is valid Will Fix The sponsor confirmed this issue will be fixed
#90 opened Oct 17, 2024 by theo-learner
2
Add RELAY_GAS_CHECK_BUFFER_INCLUDING_APPROVAL instead of increasing RELAY_GAS_CHECK_BUFFER Sponsor Confirmed The sponsor acknowledged this issue is valid Will Fix The sponsor confirmed this issue will be fixed
#89 opened Oct 17, 2024 by theo-learner
2
Use internal functions for querying nativeTokenAddress() in L1StandardBridge and L1CrossDomainMessenger Sponsor Confirmed The sponsor acknowledged this issue is valid Will Fix The sponsor confirmed this issue will be fixed
#88 opened Oct 16, 2024 by nguyenzung
1
2
Albort - • If the value of deposits[_localToken][_remoteToken] is insufficient, it can result in an underflow, causing the transaction to revert.
#83 opened Sep 25, 2024 by sherlock-admin3
Albort - The unsafe token-to-validation process
#82 opened Sep 25, 2024 by sherlock-admin2
wellbyt3 - bridgeERC20 withdraws get nativeToken stuck on L2
#81 opened Sep 25, 2024 by sherlock-admin4
0xlucky - User will lost their bridged funds through bridgeNativeToken() in Standardbridge.sol , if user using account abstraction wallet / multisig
#80 opened Sep 25, 2024 by sherlock-admin3
Albort - Lack of Access Control in finalizeDeposit
#77 opened Sep 25, 2024 by sherlock-admin4
speedy78214 - Improper initialization of L1StandardBridge will disable bridging ETH until at least one other asset is bridged
#76 opened Sep 25, 2024 by sherlock-admin3
Albort - Reentrancy leading to the unintended retention of token approvals, which can result in unauthorized token transfers
#75 opened Sep 25, 2024 by sherlock-admin2
jsmi - L11CrossDomainMessenger::sendMessage() doesn't check _minGasLimit.
#74 opened Sep 25, 2024 by sherlock-admin4
0x73696d616f - Base gas is not updated which will lead to failed l2 -> l1 message
#73 opened Sep 25, 2024 by sherlock-admin3
oxchryston - Calling the initialize function in the constructor() while passing address(0) as parameters will render contract unusable.
#72 opened Sep 25, 2024 by sherlock-admin2
10ap17 - Bridge finalization failure due to incorrect deposit accounting
#71 opened Sep 25, 2024 by sherlock-admin4
IzuMan - Paused Bridge will allow Users to Initiate a bridge and Lock Funds In the Bridge
#70 opened Sep 25, 2024 by sherlock-admin3
TessKimy - New relayMessage() implementation on L1 cross domain messenger can cause messages unreplayable even if it's failed
#69 opened Sep 25, 2024 by sherlock-admin2
CodeDesignz - [M-1] L1CrossDomainMessenger::_sendNativeTokenMessage has no check for _amount value 0, resulting in the relayMessage to trigger even for the 0 value
#68 opened Sep 25, 2024 by sherlock-admin4
CodeDesignz - [H-1] OptimismPortal2::depositTransaction function does not have access control, opening it up to bypass the protocol checks and deposit tokens on OptimismPortal2 contract
#67 opened Sep 25, 2024 by sherlock-admin3
agent3bood - Attacker will mint more tokens on L2 than deposited on L1
#66 opened Sep 25, 2024 by sherlock-admin2
oxchryston - Gasgriefing due to lack of check for paused contract in L1StandardBridge.sol and L2StandardBridge.sol
#65 opened Sep 25, 2024 by sherlock-admin4
SyncCode2017 - No validation of resolveData allowing an attacker to resolve challenges with invalid data and earn locked funds.
#64 opened Sep 25, 2024 by sherlock-admin3
OMEN - Gas Abuse in Cross-Chain Messaging
#63 opened Sep 25, 2024 by sherlock-admin2
importDev0x - Smart contract users can Bridge ETH or ERC20 tokens from their account to themselves with bridgeETHTo and bridgeERC20To functions
#62 opened Sep 25, 2024 by sherlock-admin4
0xDemon - Bridges can be frontrun by malicious actors
#61 opened Sep 25, 2024 by sherlock-admin3
ChainPatrol - Gas usage of cross-chain messages is undercounted, causing discrepancy between L1 and L2 and impacting intrinsic gas calculation
#60 opened Sep 25, 2024 by sherlock-admin2
ProTip! Adding no:label will show everything without a label.