# After proposed 0.8.0 upgrade kicks in, L2 finalizeInboundTransfer might not work

L2GraphTokenGateway's onlyL1Counterpart alias math would overflow under Solidity 0.8.0, breaking finalizeInboundTransfer for ~6.5% of gateway addresses.

- Payout: Audit contest
- Severity: medium
- Program: The Graph
- Found by: Trust
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-thegraph#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-thegraph%3AM-04
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:dos

**Target:** L2GraphTokenGateway.sol onlyL1Counterpart modifier / AddressAliasHelper.applyL1ToL2Alias
**Root cause:** applyL1ToL2Alias adds a fixed offset to the L1 address in uint160, intentionally wrapping; Solidity 0.8.0 adds checked arithmetic that reverts on overflow instead of wrapping.
**Steps:**
1. Note L2GraphTokenGateway.onlyL1Counterpart requires msg.sender == applyL1ToL2Alias(l1Counterpart).
2. applyL1ToL2Alias computes `l2Address = address(uint160(l1Address) + offset)` with offset 0x1111000000000000000000000000000000001111.
3. Under 0.8.0 checked math, if l1Address + offset exceeds uint160 max the addition reverts.
4. Example: l1Address 0xF000000000000000000000000000000000000000 plus offset overflows UINT160_MAX.
5. Result: finalizeInboundTransfer reverts for such gateway addresses (~1/15 chance).
**How found:** Read the alias helper and recognized the intentional uint160 wraparound would become a checked-arithmetic revert after the team's planned 0.7.6→0.8.0 compiler upgrade.
**Insight:** When a protocol plans a compiler upgrade, re-audit arithmetic that relies on intentional overflow/underflow (address aliasing, hashing, packing) — 0.8.0 checked math silently converts those into reverts.