# Users can DOS the token deposits for any future bridges

InitiateTokenDeposit lacks a bridge-existence check, letting anyone bump a future bridge's L1 sequence and block its first deposits on L2.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: 0xAlix2
- Disclosed: 2025-04-10
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-01-initia-rollup-modules#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Cosmos SDK L1 bridge deposit handler (x/ophost) and L2 finalize handler (x/opchild)
**Root cause:** InitiateTokenDeposit increments the per-bridge L1 sequence without verifying the bridge ID exists, so deposits to nonexistent bridge IDs advance the sequence counter that L2 finalization later validates strictly.
**Steps:**
1. Call `InitiateTokenDeposit` with a bridge ID that does not yet exist (e.g. 100); it succeeds and increments that bridge's next L1 sequence to 2.
2. Later a real bridge is created with that incremental ID; its first legitimate deposit emits L1 sequence 2.
3. Executor relays the legitimate deposit with sequence 2 to L2.
4. L2 `FinalizeTokenDeposit` compares `req.Sequence` (2) against `finalizedL1Sequence` (1) and reverts with `ErrInvalidSequence`, blocking deposits.
**How found:** Code review of InitiateTokenDeposit noticed no existence check on bridgeId before IncreaseNextL1Sequence, then traced how the emitted sequence is validated strictly on L2 in FinalizeTokenDeposit.
**Exploitation:** Attacker pre-seeds the sequence counter of a not-yet-created bridge by depositing to a guessed future bridge ID; when the bridge is created, its first real deposits carry sequence >1 and are rejected by L2's strict ordering check, denying deposit service until admin intervention.
**Insight:** When a counter is incremented before an existence/authorization check, pre-seeding it via a nonexistent resource can desync strict sequence validation on the counterpart chain; audit ordering of state mutation vs. validation.