Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OffchainLabs/token-bridge-contracts

              develop @ 7ef9d4e
            

169

Fixes

CVEs

CRITICAL

Peak severity

52.8%

Coverage

Highlights

Access Control: 63 prior fixes. Scrutinize any change in this area.

contracts/tokenbridge/ethereum/EthERC20Bridge.sol: most-fixed (13 issues). Treat as high-risk during review.

148 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Most frequent vulnerability class; many fixes add or correct caller checks (onlyRouter, onlyCounterpartGateway, onlyWhitelisted, owner) to prevent unauthorized deposits, withdrawals, and gateway reconfiguration. Missing or weak checks on these entrypoints can lead to fund theft or bridge manipulation.

Auth Bypass: Multiple fixes show the counterpart gateway modifier was using msg.sender or direct caller instead of the authenticated L2-to-L1 sender (l2ToL1Sender) or L2 alias, allowing unauthorized callers to bypass the gate and trigger privileged operations.

Logic Error / Token Theft: Critical fixes include user-controlled destinations in createRetryableTicket and mintCustomTokenFromL1, a backdoor migrate2 function, and argument swaps in constructors. These logic errors could directly drain bridge funds or deploy incorrect token templates.