Arbitrum Token Bridge

Quantstamp4 Aug 2021Files named in the report

Quantstamp reviewed Arbitrum (Arbitrum Token Bridge) on 4 Aug 2021: 9 findings, 0 critical; 4 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open Arbitrum’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	1
Low	1	4	2

HighMissing Permission Check for Function `setBridge()`Fixed

There is a missing permission check for the function `setBridge`. This could be used for DDoS attacks.

MediumERC-677 Standard Not Adhered to/Return Value UncheckedFixed

0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\gateway\ArbitrumGateway.sol`: function `inboundEscrowAndCall` does not check for whether an external call to `ERC677Receiver` actually succeeds. It is part of the [ERC677 proposal](https://github.com/ethereum/EIPs/issues/677) that `onTokenTransfer` returns a boolean that signifies success or failure. There is an assumption here that `_to` necessarily implements a revert system too. It would be much better to check for return boolean of `onTokenTransfer` and revert on failure. 0. `packages\arb-bridge-peripherals\contracts\tokenbridge\libraries\ERC677Token.sol`: `transferAndCall` ignores return value of `transfer`; same for `onTokenTransfer`.

Low[False Positive] Function `initialize()` Not ProtectedFixed

Function `initialize` is used as a `constructor`-like function and used to set important state variables for a contract. However, it seems to be `public` and not protected. Typically you expect some sort of modifier that checks whether the contract has already been initialized. It could be used as an implementation with a proxy that protects `initialize`, but this is not clear with the current scope of the audit. If that assumption is wrong then this is a severe exploit waiting to happen.

LowPrivileged Roles and OwnershipFixed

There are some actions that could have important consequences for end-users. 0. The owner of the `packages\arb-bridge-peripherals\contracts\tokenbridge\ethereum\gateway\L1GatewayRouter.sol` can call functions `setDefaultGateway` and `setGateways` at any point in time, to alter the existing token contract and gateway addresses mapping record.