Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions script/input.json
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
"vbUSDS": {
"customToken": "0x62D6A123E8D19d06d68cf0d2294F9A3A0362c6b3",
"underlyingToken": "0x2134866886ce784fE2E0DE819118E4D32b4Be32C",
"owner": "0x2De242e27386e224E5fbF110EA8406d5B70740ec",
"owner": "0xA8C31B2edd84c654d06d626383f4154D1E40C5Ff",
"name": "Vault Bridge USDS",
"symbol": "vbUSDS",
"decimals": 18,
Expand All @@ -110,7 +110,7 @@
"vbUSDC": {
"customToken": "0x203A662b0BD271A6ed5a60EdFbd04bFce608FD36",
"underlyingToken": "0xfd415D011FfaA8e6f17fa753CdB080d1dE266784",
"owner": "0x2De242e27386e224E5fbF110EA8406d5B70740ec",
"owner": "0xf4F2f5F6bAdBE05433C4604320ecC56BbECBC04E",
"name": "Vault Bridge USDC",
"symbol": "vbUSDC",
"decimals": 6,
Expand All @@ -126,13 +126,13 @@
"nonMigratableBackingPercentage": 0.01e18
},
"vbETH": {
"customToken": "0xEE7D8BCFb72bC1880D0Cf19822eB0A2e6577aB62",
"underlyingToken": "0x815955d051C6262C16c720b19D735426254Bec5B",
"owner": "0x2De242e27386e224E5fbF110EA8406d5B70740ec",
"name": "Vault Bridge Wrapped Ether",
"customToken": "0xEE7D8BCFb72bC1880D0Cf19822eB0A2e6577aB62",
"underlyingToken": "0x815955d051C6262C16c720b19D735426254Bec5B",
"owner": "0x2De242e27386e224E5fbF110EA8406d5B70740ec",
"name": "Wrapped Ether",
Copy link

@web3security web3security May 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dangerous breaking change, be careful.

Metadata changes are usually discouraged for every sovereign token. This is due to the fact that if it is sent to a non-upgradeable bridge version in a different network this getTokenMetadata(token) call at https://github.com/agglayer/agglayer-contracts/blob/v10.1.0-rc.5/contracts/v2/PolygonZkEVMBridgeV2.sol#L397 will produce a different token address in destination network as unexpected.

This seems safe for an already deployed "upgradeable token" deployed on Katana coming from a bridge from L1 (mainnet) as it will take tokenInfoHash.originToken but beware that if sent to a 3rd network (with non upgradeable tokens - 99% of them) then it will have side effects.

To avoid address change it is encouraged to use the same metadata.

Here the issue documented https://github.com/0xPolygonHermez/internal-audit/issues/160

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checking with the Product Team if the naming is crucial. If yes, we can override name, symbol, and decimals functions to report different values to LxLy Bridge.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me put an example:

  • User sends L1 vbTOK to L2 Katana (gets an upgradeable token 0xA)
  • Katana W-vbTOK token 0xA's owner changes its metadata to a different name / symbol (i.WETH).
  • User sends Katana 0xA W-vbTOK (renamed as WETH) to network LY with a non-uogradeable version (gets a different address 0xB
  • the problem is not 0xA != 0xB because those networks use different bridge type (upgradeable wrapped tokens vs non upgradeable)
  • the problem is that non-upgradeable networks will have different addresses for the same asset depending on whether or not the first deposit came from Katana (with a renamed metadata) or for example L1 with the original naming.
  • so the problem is that if a user sends vbTOK from L1 to LY+1, that W-vbTOK will get an address of 0xC which is different from != 0xB

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The solution I proposed fixes the issue because LxLy Bridge will see the original metadata, while everyone else will see the new metadata. So, the same bridge-wrapped token will be used no matter if you bridge from Ethereum or Katana.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simonDos Per the internal discussions, revert the naming to Vault Bridge ETH / vbETH.

"symbol": "WETH",
"decimals": 18,
"nonMigratableGasBackingPercentage": 0.01e18
"nonMigratableGasBackingPercentage": 0.1e18
},
"migrationManager": "0x417d01B64Ea30C4E163873f3a1f77b727c689e02",
"polygonEngineeringMultisig": "0x4e981bAe8E3cd06Ca911ffFE5504B2653ac1C38a",
Expand Down Expand Up @@ -210,4 +210,4 @@
"yieldVaultMaximumSlippagePercentage": 0
}
}
}
}