Skip to content
Request an audit

‹ All findings

Token addresses are not validated in BRC20Factory and Vault, so users can use incorrect tokens

Low/InfoOrange Bridge·Three Sigma · Cross-chain bridge · 15th July, 20243S-OB-L02

ReportSource

Description

BRC20Factory::mint(), BRC20Factory::burn(), Vault::deposit() and Vault::withdraw() allow sending any token, which could lead to problems if the token is not a BRC20.

Recommendation

Validate the sent token was created by the factory. To do this an isBRC20 mapping should be added to BRC20Factory which stores all the tokens that were created by it.

Status

Addressed in #1cd9410.