Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: adapt combo on opbnb v0.5.2 alpha.1 #40

Merged
merged 3,127 commits into from
Feb 19, 2025

fix chain config

189e341
Select commit
Loading
Failed to load commit list.
Merged

feat: adapt combo on opbnb v0.5.2 alpha.1 #40

fix chain config
189e341
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Slither succeeded Feb 18, 2025 in 3s

28 new alerts including 28 medium severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 28 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 362 in packages/contracts-bedrock/src/L1/OptimismPortal.sol

See this annotation in the file changed.

Code scanning / Slither

Dangerous usage of `tx.origin` Medium

OptimismPortal.finalizeWithdrawalTransaction(Types.WithdrawalTransaction) uses tx.origin for authorization: success == false && tx.origin == Constants.ESTIMATION_ADDRESS

Check warning on line 430 in packages/contracts-bedrock/src/L1/OptimismPortal.sol

See this annotation in the file changed.

Check warning on line 50 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Code scanning / Slither

Write after write Medium

OptimismPortal2.l2Sender is written in both
l2Sender = _tx.sender
l2Sender = Constants.DEFAULT_L2_SENDER

Check warning on line 312 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Check warning on line 387 in packages/contracts-bedrock/src/L1/OptimismPortal2.sol

See this annotation in the file changed.

Check warning on line 151 in packages/contracts-bedrock/src/L1/ResourceMetering.sol

See this annotation in the file changed.

Check warning on line 215 in packages/contracts-bedrock/src/L1/SystemConfig.sol

See this annotation in the file changed.

Check warning on line 116 in packages/contracts-bedrock/src/Safe/LivenessGuard.sol

See this annotation in the file changed.

Check warning on line 148 in packages/contracts-bedrock/src/Safe/LivenessGuard.sol

See this annotation in the file changed.

Code scanning / Slither

Unused return Medium

LivenessGuard.checkAfterExecution(bytes32,bool) ignores return value by ownersBefore.remove(ownerBefore)

Check warning on line 615 in packages/contracts-bedrock/src/cannon/PreimageOracle.sol

See this annotation in the file changed.

Code scanning / Slither

Uninitialized local variables Medium

PreimageOracle.challengeFirstLPP(address,uint256,PreimageOracle.Leaf,bytes32[]).stateMatrix is a local variable never initialized

Check warning on line 72 in packages/contracts-bedrock/src/dispute/DisputeGameFactory.sol

See this annotation in the file changed.

Code scanning / Slither

Unused return Medium

DisputeGameFactory.games(GameType,Claim,bytes) ignores return value by (None,timestamp,proxy) = _disputeGames[uuid].unpack()

Check warning on line 186 in packages/contracts-bedrock/src/dispute/DisputeGameFactory.sol

See this annotation in the file changed.

Code scanning / Slither

Tautology or contradiction Medium

DisputeGameFactory.findLatestGames(GameType,uint256,uint256) contains a tautology or contradiction:
- i >= 0 && i <= _start

Check warning on line 220 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Reentrancy vulnerabilities Medium

Reentrancy in FaultDisputeGame.step(uint256,bool,bytes,bytes):
External calls:
- validStep = VM.step(_stateData,_proof,uuid.raw()) == postState.claim.raw()
State variables written after the call(s):
- parent.counteredBy = msg.sender
FaultDisputeGame.claimData can be used in cross function reentrancies:
- FaultDisputeGame._findStartingAndDisputedOutputs(uint256)
- FaultDisputeGame._findTraceAncestor(Position,uint256,bool)
- FaultDisputeGame.claimData
- FaultDisputeGame.claimDataLen()
- FaultDisputeGame.getChallengerDuration(uint256)
- FaultDisputeGame.initialize()
- FaultDisputeGame.move(Claim,uint256,Claim,bool)
- FaultDisputeGame.resolve()
- FaultDisputeGame.resolveClaim(uint256,uint256)
- FaultDisputeGame.step(uint256,bool,bytes,bytes)

Check warning on line 364 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Check warning on line 364 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Check warning on line 364 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Check warning on line 364 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Check warning on line 364 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Check warning on line 659 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Reentrancy vulnerabilities Medium

Reentrancy in FaultDisputeGame.resolveClaim(uint256,uint256):
External calls:
- _distributeBond(recipient,subgameRootClaim)
- WETH.unlock(_recipient,bond)
State variables written after the call(s):
- resolvedSubgames[_claimIndex] = true
FaultDisputeGame.resolvedSubgames can be used in cross function reentrancies:
- FaultDisputeGame.resolve()
- FaultDisputeGame.resolveClaim(uint256,uint256)
- FaultDisputeGame.resolvedSubgames

Check warning on line 659 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Reentrancy vulnerabilities Medium

Reentrancy in FaultDisputeGame.resolveClaim(uint256,uint256):
External calls:
- _distributeBond(challenger,subgameRootClaim)
- WETH.unlock(_recipient,bond)
State variables written after the call(s):
- subgameRootClaim.counteredBy = challenger
FaultDisputeGame.claimData can be used in cross function reentrancies:
- FaultDisputeGame._findStartingAndDisputedOutputs(uint256)
- FaultDisputeGame._findTraceAncestor(Position,uint256,bool)
- FaultDisputeGame.claimData
- FaultDisputeGame.claimDataLen()
- FaultDisputeGame.getChallengerDuration(uint256)
- FaultDisputeGame.initialize()
- FaultDisputeGame.move(Claim,uint256,Claim,bool)
- FaultDisputeGame.resolve()
- FaultDisputeGame.resolveClaim(uint256,uint256)
- FaultDisputeGame.step(uint256,bool,bytes,bytes)

Check warning on line 659 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Reentrancy vulnerabilities Medium

Reentrancy in FaultDisputeGame.resolveClaim(uint256,uint256):
External calls:
- _distributeBond(subgameRootClaim.claimant,subgameRootClaim)
- WETH.unlock(_recipient,bond)
- _distributeBond(countered,subgameRootClaim)
- WETH.unlock(_recipient,bond)
State variables written after the call(s):
- subgameRootClaim.counteredBy = countered
FaultDisputeGame.claimData can be used in cross function reentrancies:
- FaultDisputeGame._findStartingAndDisputedOutputs(uint256)
- FaultDisputeGame._findTraceAncestor(Position,uint256,bool)
- FaultDisputeGame.claimData
- FaultDisputeGame.claimDataLen()
- FaultDisputeGame.getChallengerDuration(uint256)
- FaultDisputeGame.initialize()
- FaultDisputeGame.move(Claim,uint256,Claim,bool)
- FaultDisputeGame.resolve()
- FaultDisputeGame.resolveClaim(uint256,uint256)
- FaultDisputeGame.step(uint256,bool,bytes,bytes)

Check warning on line 777 in packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Uninitialized local variables Medium

FaultDisputeGame.getChallengerDuration(uint256).parentClock is a local variable never initialized

Check warning on line 102 in packages/contracts-bedrock/src/dispute/PermissionedDisputeGame.sol

See this annotation in the file changed.

Code scanning / Slither

Dangerous usage of `tx.origin` Medium

PermissionedDisputeGame.initialize() uses tx.origin for authorization: tx.origin != PROPOSER

Check warning on line 132 in packages/contracts-bedrock/src/periphery/faucet/Faucet.sol

See this annotation in the file changed.

Check warning on line 126 in packages/contracts-bedrock/src/universal/CrossDomainMessenger.sol

See this annotation in the file changed.