Arbitrum Token Bridge

Quantstamp4 Aug 2021Files named in the report

Quantstamp reviewed Arbitrum (Arbitrum Token Bridge) on 4 Aug 2021: 9 findings, 0 critical; 4 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open Arbitrum’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	1	4	2

LowDangerous External Calls From `TokenGateway`s to Arbitrary Contact by AnyoneAcknowledged

The function `transferExitAndCall` can be called by any user to call any external contracts. This enables a user to have privilege of the `TokenGateway` contract and could be used as a tool to conduct a complex attack.

LowGreedy ContractAcknowledged

A greedy contract is a contract that can receive ether which can never be redeemed.

LowMissing Checks if Address Is Non-ZeroAcknowledged

There are many functions that do not validate input addresses. A list of them is provided below, but they might not be comprehensive since there are too many of them. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\ArbitrumMessenger.sol`: `sendTxToL2`, `sendTxToL1`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\GatewayRouter.sol`: `_initialize`, `setDefaultGateway`, `outboundTransfer`, `finalizeInboundTransfer`, `inboundExcrowAndCall`, `getOutboundCalldata`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1GatewayRouter.sol`: `_initialize`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\ArbitrumGateway.sol`: `_initialize`, `outboundTransfer`, `finalizeInboundTransfer`, `inboundExcrowAndCall`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\TokenGateway.sol`: `_initialize`, `isRouter`, `isCounterpartGateway`, `calculateL2TokenAddress`, `getOutboundCalldata`, `finalizeInboundTransfer`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1ArbitrumGateway.sol`: `_initialize` `getExternalCall`, `createOutboundTx`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1ArbitrumExtendedGateway.sol`: `transferExitAndCall`, `getExternalCall`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1CustomGateway.sol`: `initialize`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\arbitrum\gateway\L2ArbitrumGateway.sol`: `_initialize`, `createOutboundTx`, `getOutboundCalldata`, `outboundTransfer`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\L2GatewayToken.sol`: `_initialize`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\arbitrum\gateway\L2ERC20Gateway.sol`: `_initialize`, `handleNoContract`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\arbitrum\gateway\L2WethGateway.sol`: `_initialize`, `handleNoContract`, `outBoundEscrowTransfer`, `_calculateL2TokenAddress`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\arbitrum\gateway\L2CustomGateway.sol`: `_initialize`, `handleNoContract`. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\aeWETH.sol`: `_initialize`.

LowUnlocked PragmaAcknowledged

Every Solidity file specifies in the header a version number of the format pragma solidity (^)0.8.*. The caret (^) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version and above, hence the term "unlocked".