zkSync Era - Nyx's results

Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/facets/Mailbox.sol#L275-L281

Vulnerability details

Impact

After some transactions, the deposit functions from bridges can't be usable until the deposit limit is disabled.

Proof of Concept

When a user uses the deposit() function to transfer WETH or any ERC20 from L1 to L2, the _verifyDepositLimit() function checks for a deposit limit.

_verifyDepositLimit(msg.sender, msg.value);

When bridging WETH, the L1WETHBridge's deposit limit is checked, not the user's.

function _verifyDepositLimit(address _depositor, uint256 _amount) internal {
        IAllowList.Deposit memory limitData = IAllowList(s.allowList).getTokenDepositLimitData(address(0)); // address(0) denotes the ETH
        if (!limitData.depositLimitation) return; // no deposit limitation is placed for ETH

        require(s.totalDepositedAmountPerUser[_depositor] + _amount <= limitData.depositCap, "d2"); //@audit !!
        s.totalDepositedAmountPerUser[_depositor] += _amount;
    }

The function will revert if the totalDepositedAmountPerUser exceeds the depositCap, which can be quickly inflated by transactions and prevent users from bridging their assets.

Tools Used

Manual Review

Recommended Mitigation Steps

the _verifyDepositLimit() needs to check the user's deposit limit instead of bridges.

Assessed type

DoS