# L1Migrator.migrateLPT can be used to take away protocol's access to LPT tokens in BridgeMinter

Anyone can call L1Migrator.migrateLPT once with bad retryable-ticket params, stranding BridgeMinter's LPT in escrow and DoSing migration via frontrunning.

- Payout: Audit contest
- Severity: medium
- Program: Livepeer
- Found by: Ruhum
- Disclosed: 2022-02-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-livepeer-findings/issues/97
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-livepeer%3AM-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** L1Migrator / BridgeMinter bridge contracts (Arbitrum L1-L2)
**Root cause:** migrateLPT is permissionless and one-shot: it uses the amount returned by withdrawLPTToL1Migrator, so after the first call BridgeMinter returns 0 and the single RetryableTicket is the only chance to move funds. Attacker-supplied ticket params can make L2 ticket creation fail.
**Steps:**
1. Call `L1Migrator.migrateLPT()` with retryable-ticket parameters (gas limits/deposit) that cause the L2 RetryableTicket creation to fail.
2. BridgeMinter.withdrawLPTToL1Migrator() returns its full LPT balance and sends it toward escrow; the failed ticket leaves funds stranded.
3. Subsequent calls return amount=0 since BridgeMinter is drained, so migration cannot complete.
4. To reset, funds must be moved from Escrow back to BridgeMinter; attacker frontruns each retry to fail the ticket again.
**How found:** Noticed migrateLPT is callable by anyone and only executable once because amount comes from withdrawLPTToL1Migrator which zeroes after first call; reasoned that attacker-controlled ticket params could fail the single L2 ticket.
**Exploitation:** Permissionless call with crafted L1->L2 message params makes the one-shot RetryableTicket fail; LPT ends up in escrow and migration is blocked. Persistent attacker frontruns recovery attempts to keep DoSing.
**Escalation:** Frontrunning repeated recovery/reset attempts to sustain the DoS.
**Insight:** For one-shot permissionless bridge/migration functions, check whether caller-supplied L2 message params (gas/deposit) can make the retryable ticket fail while state is already mutated; also check whether the amount source is a draining getter that zeroes after first use.