Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Mantle>Threat Models>finalizeDeposit
GeneralOverview
Findings
High (1)
Low (1)
Informational (2)
DiscussionCentralization riskOwnership transfer
Threat ModelsWhat are threat models?L1MantleToken.solL1StandardBridge.sol
L2StandardBridge.solfinalizeDepositwithdrawwithdrawTo
MantleTokenMigrator.sol
Audit ResultsSummary

Function: finalizeDeposit(address _l1Token, address _l2Token, address _from, address _to, uint256 _amount, byte[] _data)

Finalizes deposit of tokens from L1 to L2.

Inputs

  • _l1Token

    • Control: User.

    • Constraints: Discarded.

    • Impact: The L1 token.

  • _l2Token

    • Control: User.

    • Constraints: Discarded.

    • Impact: The L2 token.

  • _from

    • Control: User.

    • Constraints: Discarded.

    • Impact: The address from which deposit takes place.

  • _to

    • Control: User.

    • Constraints: Discarded.

    • Impact: The address to which deposit takes place.

  • _amount

    • Control: User.

    • Constraints: Discarded.

    • Impact: Amount of tokens.

  • _data

    • Control: User.

    • Constraints: Discarded.

    • Impact: Optional data.

Branches and code coverage (including function calls)

Intended branches

  • Successfully finalizes deposit if all conditions are met.

Negative behavior

  • Reverts on calls from a non-crossDomainMessenger L2 account.

Function call analysis

  • finalizeDeposit -> ERC165Checker.supportsInterface(_l2Token, 0x1d1d8b63)

    • What is controllable? _l2Token.

    • If return value controllable, how is it used and how can it go wrong? Discarded.

    • What happens if it reverts, reenters, or does other unusual control flow? Discarded.

  • finalizeDeposit -> IL2StandardERC20(_l2Token).l1Token()

    • What is controllable? _l2Token.

    • If return value controllable, how is it used and how can it go wrong? Discarded.

    • What happens if it reverts, reenters, or does other unusual control flow? Discarded.

  • finalizeDeposit -> IL2StandardERC20(_l2Token).mint(_to, _amount)

    • What is controllable? _l2Token, _to, and _amount.

    • If return value controllable, how is it used and how can it go wrong? Discarded.

    • What happens if it reverts, reenters, or does other unusual control flow? Discarded.

  • finalizeDeposit -> sendCrossDomainMessage(l1TokenBridge, 0, message)

    • What is controllable? l1TokenBridge.

    • If return value controllable, how is it used and how can it go wrong? Discarded.

    • What happens if it reverts, reenters, or does other unusual control flow? Discarded.

Zellic © 2025Back to top ↑