fix: [L02] prevent locking in the case of misparameterization

contracts/PolygonTokenBridger.sol

@@ -54,6 +54,9 @@ contract PolygonTokenBridger is Lockable {
     // WETH contract on Ethereum.
     WETH9 public immutable l1Weth;
 
+    // Wrapped Matic on Polygon
+    address public immutable l2WrappedMatic;
+
     // Chain id for the L1 that this contract is deployed on or communicates with.
     // For example: if this contract were meant to facilitate transfers from polygon to mainnet, this value would be
     // the mainnet chainId 1.
@@ -82,12 +85,14 @@ contract PolygonTokenBridger is Lockable {
         address _destination,
         PolygonRegistry _l1PolygonRegistry,
         WETH9 _l1Weth,
+        address _l2WrappedMatic,
         uint256 _l1ChainId,
         uint256 _l2ChainId
     ) {
         destination = _destination;
         l1PolygonRegistry = _l1PolygonRegistry;
         l1Weth = _l1Weth;
+        l2WrappedMatic = _l2WrappedMatic;
         l1ChainId = _l1ChainId;
         l2ChainId = _l2ChainId;
     }
@@ -97,20 +102,16 @@ contract PolygonTokenBridger is Lockable {
      * @notice The caller of this function must approve this contract to spend amount of token.
      * @param token Token to bridge.
      * @param amount Amount to bridge.
-     * @param isWrappedMatic True if token is WMATIC.
      */
-    function send(
-        PolygonIERC20 token,
-        uint256 amount,
-        bool isWrappedMatic
-    ) public nonReentrant onlyChainId(l2ChainId) {
+    function send(PolygonIERC20 token, uint256 amount) public nonReentrant onlyChainId(l2ChainId) {
         token.safeTransferFrom(msg.sender, address(this), amount);
 
         // In the wMatic case, this unwraps. For other ERC20s, this is the burn/send action.
-        token.withdraw(amount);
+        token.withdraw(token.balanceOf(address(this)));
 
         // This takes the token that was withdrawn and calls withdraw on the "native" ERC20.
-        if (isWrappedMatic) maticToken.withdraw{ value: amount }(amount);
+        if (address(token) == l2WrappedMatic)
+            maticToken.withdraw{ value: address(this).balance }(address(this).balance);
     }
 
     /**

contracts/Polygon_SpokePool.sol

@@ -212,11 +212,7 @@ contract Polygon_SpokePool is IFxMessageProcessor, SpokePool {
         );
 
         // Note: WrappedNativeToken is WMATIC on matic, so this tells the tokenbridger that this is an unwrappable native token.
-        polygonTokenBridger.send(
-            PolygonIERC20(relayerRefundLeaf.l2TokenAddress),
-            relayerRefundLeaf.amountToReturn,
-            address(wrappedNativeToken) == relayerRefundLeaf.l2TokenAddress
-        );
+        polygonTokenBridger.send(PolygonIERC20(relayerRefundLeaf.l2TokenAddress), relayerRefundLeaf.amountToReturn);
 
         emit PolygonTokensBridged(relayerRefundLeaf.l2TokenAddress, address(this), relayerRefundLeaf.amountToReturn);
     }

test/chain-specific-spokepools/Polygon_SpokePool.ts

@@ -26,7 +26,7 @@ describe("Polygon Spoke Pool", function () {
 
     const polygonTokenBridger = await (
       await getContractFactory("PolygonTokenBridger", owner)
-    ).deploy(hubPool.address, polygonRegistry.address, weth.address, l1ChainId, l2ChainId);
+    ).deploy(hubPool.address, polygonRegistry.address, weth.address, weth.address, l1ChainId, l2ChainId);
 
     dai = await (await getContractFactory("PolygonERC20Test", owner)).deploy();
     await dai.addMember(TokenRolesEnum.MINTER, owner.address);
@@ -221,7 +221,7 @@ describe("Polygon Spoke Pool", function () {
     const l2ChainId = randomBigNumber();
     const polygonTokenBridger = await (
       await getContractFactory("PolygonTokenBridger", owner)
-    ).deploy(hubPool.address, polygonRegistry.address, weth.address, l1ChainId, l2ChainId);
+    ).deploy(hubPool.address, polygonRegistry.address, weth.address, weth.address, l1ChainId, l2ChainId);
 
     await expect(() =>
       owner.sendTransaction({ to: polygonTokenBridger.address, value: toWei("1") })
@@ -242,7 +242,7 @@ describe("Polygon Spoke Pool", function () {
 
     const polygonTokenBridger = await (
       await getContractFactory("PolygonTokenBridger", owner)
-    ).deploy(hubPool.address, polygonRegistry.address, weth.address, l1ChainId, l2ChainId);
+    ).deploy(hubPool.address, polygonRegistry.address, weth.address, weth.address, l1ChainId, l2ChainId);
 
     // Cannot call retrieve on the contract on L2.
     await weth.connect(owner).transfer(polygonTokenBridger.address, toWei("1"));
@@ -263,12 +263,12 @@ describe("Polygon Spoke Pool", function () {
 
     const polygonTokenBridger = await (
       await getContractFactory("PolygonTokenBridger", owner)
-    ).deploy(hubPool.address, polygonRegistry.address, weth.address, l1ChainId, l2ChainId);
+    ).deploy(hubPool.address, polygonRegistry.address, weth.address, weth.address, l1ChainId, l2ChainId);
 
     await weth.connect(owner).approve(polygonTokenBridger.address, toWei("1"));
 
     // Cannot call send on the contract on L1.
-    await expect(polygonTokenBridger.connect(owner).send(weth.address, toWei("1"), false)).to.be.revertedWith(
+    await expect(polygonTokenBridger.connect(owner).send(weth.address, toWei("1"))).to.be.revertedWith(
       "Cannot run method on this chain"
     );
   });
@@ -281,7 +281,7 @@ describe("Polygon Spoke Pool", function () {
 
     const polygonTokenBridger = await (
       await getContractFactory("PolygonTokenBridger", owner)
-    ).deploy(hubPool.address, polygonRegistry.address, weth.address, l1ChainId, l2ChainId);
+    ).deploy(hubPool.address, polygonRegistry.address, weth.address, weth.address, l1ChainId, l2ChainId);
 
     // Cannot call send on the contract on L1.
     const exitBytes = "0x" + randomBytes(100).toString("hex");