rvierdiiev - Relayer can call OptimismPortal.proveWithdrawalTransaction and OptimismPortal.finalizeWithdrawalTransaction for his own withdraw

[github-actions]

rvierdiiev

low

Relayer can call OptimismPortal.proveWithdrawalTransaction and OptimismPortal.finalizeWithdrawalTransaction for his own withdraw

Summary

Relayer can call OptimismPortal.proveWithdrawalTransaction and OptimismPortal.finalizeWithdrawalTransaction for his own withdraw, however docs says that he should not be able to do that.

Vulnerability Detail

https://github.com/ethereum-optimism/optimism/blob/f30376825c82f62b846590487fe46b7435213d37/specs/withdrawals.md#on-l1
Withdraw documentation states that relayer should not call OptimismPortal.proveWithdrawalTransaction for the withdraws that he created himself.

1.A relayer submits the required inputs to the OptimismPortal contract. The relayer need not be the same entity which initiated the withdrawal on L2.

Also same is said about calls of OptimismPortal.finalizeWithdrawalTransaction.

5.Once the challenge period has passed, a relayer submits the withdrawal transaction once again to the OptimismPortal contract. Again, the relayer need not be the same entity which initiated the withdrawal on L2.

However there is no such check in both functions, they do not check that caller of function is not initiator of withdrawal on L2.

Impact

Relayer can submit withdrawal tx to OptimismPortal, when he is initiator of withdrawal on L2.

Code Snippet

https://github.com/sherlock-audit/2023-01-optimism/blob/main/optimism/packages/contracts-bedrock/contracts/L1/OptimismPortal.sol#L160-L344

Tool used

Manual Review

Recommendation

State in line with your docs.

Duplicate of #107