# Gasless ETH bridging from L1 to L2

OptimismPortal.depositTransaction accepts zero gasLimit, letting users bridge ETH to L2 without prepaying L2 gas and bypassing resource metering.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: tnch
- Disclosed: 2023-01-19
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/71
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:fee-bypass

**Target:** OptimismPortal.depositTransaction L1->L2 deposit
**Root cause:** depositTransaction enforces no minimum gas limit, so a zero gasLimit deposit consumes no prevBoughtGas, bypasses MAX_RESOURCE_LIMIT and gas burning, yet still mints msg.value on L2 even when L2 execution fails.
**Steps:**
1. Call `OptimismPortal.depositTransaction(to, value=1 wei, gasLimit=0, isCreation=false, data=0x)` on L1.
2. Observe L1 tx succeeds with zero resource metering cost and no gas burn.
3. Observe corresponding L2 tx fails but still mints 1 wei to the recipient and increments nonce.
4. Repeat to fill deposit blocks up to ~4 MB without paying L2 resource costs.
**How found:** Code review of depositTransaction and ResourceMetering: noticed no minimum gas limit check, traced prevBoughtGas accumulation and op-geth state_transition mint-on-failure behavior, then confirmed with a live Goerli tx pair.
**Exploitation:** Attacker submits many zero-gasLimit deposits with positive msg.value, paying only L1 gas; each mints ETH on L2 despite failed execution, and blocks can be filled with uncompensated deposit data burdening the sequencer.
**Escalation:** Scaling to ~3500 deposits per L1 block / 4 MB deposit blocks to DoS sequencer processing without compensation.
**Insight:** When auditing L1->L2 deposit paths, check whether the user-supplied gas limit gates resource accounting; a zero limit can skip metering while state-changing mints still apply on failure.