Proof-of-Concept: Rebase Token Inflation Attack on Optimism L1StandardBridge

This repository contains a functional Proof-of-Concept (PoC) demonstrating a critical vulnerability in the L1StandardBridge contract on the Optimism network. The vulnerability allows for an asset inflation attack using a malicious ERC20 token that employs a "fee-on-transfer" or "rebase" mechanism.

The bridge contract does not correctly account for the actual amount of tokens transferred when such a mechanism is present, leading to a discrepancy that can be exploited to mint unbacked assets on the L2 network.

Vulnerability Details

• Contract: L1StandardBridge
• Function: depositERC20()
• Attack Type: Asset Inflation / Fake Deposit
• Mechanism: The bridge calculates the deposit amount before the transferFrom call. A malicious token can implement logic within its _transfer function to send fewer tokens than the amount specified, while the bridge proceeds to credit the full, original amount on L2.

How the PoC Works

The attack.js script automates the entire attack sequence on the Sepolia testnet:

1. Deploy MaliciousToken.sol: A custom ERC20 token is deployed. This token's _transfer function is engineered to send a smaller amount of tokens than requested, simulating a rebase or fee mechanism.
2. Mint Tokens: The script mints an initial supply of the malicious token to the attacker's wallet.
3. Approve Bridge: The attacker approves the L1StandardBridge contract to spend these tokens.
4. Execute Attack: The script calls the depositERC20 function on the L1StandardBridge. It requests to deposit the full amount of tokens, but the malicious contract ensures only a fraction is actually transferred.
5. Result: The bridge, having received fewer tokens than it believes, proceeds to finalize the deposit on L2 for the full amount, effectively creating "fake" assets from nothing.

Setup and Execution

Prerequisites

• Node.js
• Git
• A .env file with the following keys:
  • SEPOLIA_RPC_URL: An Alchemy or Infura RPC URL for the Sepolia testnet.
  • PRIVATE_KEY: The private key of a funded Sepolia testnet account.

Steps to Reproduce

1. Clone the repository:

   git clone <your-private-repo-url>
   cd optimism-attack-poc

2. Install dependencies:

   npm install

3. Create and fund a test account:

   • Create a new account in MetaMask.
   • Fund it with Sepolia ETH from a faucet (e.g., sepoliafaucet.com).
   • Add the account's private key and your RPC URL to the .env file.

4. Compile the contracts:

   npx hardhat compile

5. Run the attack script:

   npx hardhat run scripts/attack.js --network sepolia

Upon successful execution, the script will output the transaction hash of the successful attack, which can be verified on the Sepolia Etherscan.

---

Author & Security Researcher

This vulnerability was discovered and this Proof-of-Concept was developed by:

Eng.Maeen Ahmed Qasem Al-GUMAEI

---

DISCLAIMER: This code is for educational and responsible disclosure purposes only. Do not use it for any malicious activities.