# Challenger can override the 7 day finalization period

L2OutputOracle.deleteL2Outputs lacks a finalization-period check, letting the challenger delete already-finalized outputs and block confirmed withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: unforgiven
- Disclosed: 2023-01-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/75
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** L2OutputOracle.deleteL2Outputs (contracts-bedrock L1)
**Root cause:** deleteL2Outputs only checks the caller is CHALLENGER and the index is in range; it never verifies the output's timestamp is within the finalization window, so outputs older than 7 days can be deleted.
**Steps:**
1. Proposer calls `proposeL2Output` creating l2Output at index X.
2. User calls `proveWithdrawalTransaction` referencing index X.
3. Wait past FINALIZATION_PERIOD_SECONDS (7 days).
4. Challenger calls `deleteL2Outputs(X)`; assembly `sstore(l2Outputs.slot, X)` truncates the array.
5. User's `finalizeWithdrawalTransaction` reverts because index X no longer exists.
**How found:** Code review of deleteL2Outputs against the withdrawals spec: noticed no timestamp/finalization check, contradicting the guarantee that finalized withdrawals are confirmed.
**Exploitation:** Challenger (trusted role) deletes a finalized output index, invalidating proofs bound to it; user withdrawals revert and, if a different output root is proven, funds can be permanently stuck.
**Insight:** In optimistic-rollup contracts, audit every privileged mutation (delete/replace) of output roots against the finalization-window invariant; a trusted role can still violate user guarantees if the timestamp check is missing.