# Freeze Bridge via Non-UTF8 Token Name/Symbol/Denom

Permissionless ERC20 deploy with non-UTF8 symbol makes orchestrator's event parser error and early-return, halting attestations and freezing the Gravity bridge.

- Payout: Audit contest
- Severity: high
- Program: Althea Gravity Bridge
- Found by: nascent
- Disclosed: 2021-08-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-08-gravitybridge-findings/issues/4
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:rust tech:solidity technique:chained technique:source-review vuln:dos

**Target:** Gravity.sol ERC20 deploy call + Rust orchestrator event watcher
**Root cause:** Solidity contract accepts arbitrary bytes for denom/name/symbol; Rust orchestrator does String::from_utf8 and returns Err on invalid UTF8, causing early return before updating last-checked block.
**Steps:**
1. Call `gravity.call(data)` with ERC20DeployedEvent calldata where symbol bytes end in `c0` (invalid UTF8), e.g. `hex"f7955637...73796d626fc0"`.
2. Contract emits ERC20DeployedEvent with non-UTF8 symbol.
3. Orchestrator's `Erc20DeployedEvent::from_logs` hits `String::from_utf8` error and returns `GravityError::InvalidEventLogError`.
4. `ethereum_event_watcher.rs` early-returns on `?`, never updating last checked block.
5. All subsequent attestations stall; bridge frozen.
**How found:** Code review of the Rust event parser's UTF8 handling combined with noticing the Solidity contract does not validate string encoding; crafted calldata to confirm the parse failure and early-return path.
**Exploitation:** Any user submits a permissionless ERC20 deploy tx with invalid UTF8 symbol; orchestrators repeatedly fail parsing the same event and never advance their block cursor, permanently halting attestations until a new Gravity.sol is deployed.
**Insight:** When an off-chain watcher parses on-chain events, check whether any string field is attacker-controlled and unvalidated on-chain; a single unparseable event that aborts the watcher loop before cursor update becomes a permanent liveness DoS.