Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

cmichel - Spec: Wrong description of withdrawal process #94

Open
github-actions bot opened this issue Feb 20, 2023 · 0 comments
Open

cmichel - Spec: Wrong description of withdrawal process #94

github-actions bot opened this issue Feb 20, 2023 · 0 comments
Labels
Has Duplicates A valid issue with 1+ other issues describing the same vulnerability Reward A payout will be made for this issue Specification An issue related to the specification (low severity)

Comments

@github-actions
Copy link

cmichel

low

Spec: Wrong description of withdrawal process

Summary

Wrong description of the withdrawal process in the spec.

Vulnerability Detail

The withdrawals.md describes the second step of the withdrawal process as:

  1. The OptimismPortal contract retrieves the output root for the given block number from the L2OutputOracle's
    getL2OutputAfter() function, and performs the remainder of the verification process internally.

The getL2OutputAfter call is never performed. This function does not even exist, most likely, it was referring to getL2OutputIndexAfter. However, even this function is not called. What happens in the withdrawal process is that getL2Output is called to retrieve the output root for the given block number (index).

Impact

The withdrawal process should be clearly documented in the spec. Currently, it's referring to a non-existant function.

Code Snippet

https://github.com/ethereum-optimism/optimism/blob/3f4b3c328153a8aa03611158b6984d624b17c1d9/specs/withdrawals.md?plain=1#L67

Tool used

Manual Review

Recommendation

Fix the spec by referring to getL2Output(l2OutputIndex) instead.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Has Duplicates A valid issue with 1+ other issues describing the same vulnerability Reward A payout will be made for this issue Specification An issue related to the specification (low severity)
Projects
None yet
Development

No branches or pull requests

1 participant