zkSync Era - mahdirostami's results

Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/facets/Mailbox.sol#L261

Vulnerability details

Summary

The _verifyDepositLimit function is used to check if there is a deposit limit for ETH and ensures that users do not exceed their deposit limit. However, when the requestL2Transaction function is called by a bridge, it uses msg.sender as the user's address for the _verifyDepositLimit function, which is not appropriate (msg.sender is bridge).

 _verifyDepositLimit(msg.sender, msg.value);

Impact

This inconsistency in using msg.sender in the _verifyDepositLimit function can lead to the totalDepositedAmountPerUser variable increasing for bridges instead of users.

Tools Used

Manual review

Recommendations

To maintain consistency and ensure that the function operates as intended, consider using msg.origin instead of msg.sender when calling _verifyDepositLimit in the requestL2Transaction function:

 _verifyDepositLimit(msg.origin, msg.value);

This ensures that the deposit limit check is applied to the actual user rather than the bridge.

Assessed type

Invalid Validation