050.md

cmichel

low

Bridging L2 native ERC721s are lost forever, contrary to comment

Summary

Bridging L2 native ERC721s are lost forever, contrary to dev comment.

Vulnerability Detail

The L2ERC721Bridge has this comment:

**WARNING**: Do not bridge an ERC721 that was originally deployed on Optimism. This
 *         bridge ONLY supports ERC721s originally deployed on Ethereum. Users will need to
 *         wait for the one-week challenge period to elapse before their Optimism-native NFT
 *         can be refunded on L2.
 */

However, there does not seem to be any kind of "one-week challenge period" in the contract or any way to refund native L2 NFTs.

Impact

Native L2 tokens most likely cannot be bridged because they don't implement the IOptimismMintableERC721 interface with the remoteToken() function, but this comment gives a wrong sense of security for users that they could indeed be refunded if their L2 native NFT ends up in the bridge contract.

Code Snippet

https://github.com/ethereum-optimism/optimism/blob/3f4b3c328153a8aa03611158b6984d624b17c1d9/packages/contracts-bedrock/contracts/L2/L2ERC721Bridge.sol#L17-L19

Tool used

Manual Review

Recommendation

Remove the:

"Users will need to wait for the one-week challenge period to elapse before their Optimism-native NFT can be refunded on L2." line from the comment.