# Migration can be bricked by sending a message directly to the LegacyMessagePasser

Anyone can call LegacyMessagePasser.passMessageToL1 directly with malformed calldata, breaking the Optimism state migration's format assumptions and bricking the migration.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: 0xdeadbeef
- Disclosed: 2023-01-19
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-optimism-judging/issues/105
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-9
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** LegacyMessagePasser predeploy (0x00) and op-chain-ops migration tooling
**Root cause:** Migration assumes every stored withdrawal came from L2CrossDomainMessenger with relayMessage selector, but passMessageToL1 is public and accepts arbitrary calldata, so a direct call violates both checks and aborts migration.
**Steps:**
1. Observe l2geth writes any call to MessagePasserAddress into withdrawal dump via statedumper.WriteMessage.
2. Note migration validates data[0:4] == keccak256('relayMessage(address,address,bytes,uint256)')[0:4] and trailing bytes == L2CrossDomainMessengerAddr.
3. Call LegacyMessagePasser.passMessageToL1(`0xdeadbeef`) directly from an EOA with calldata not matching the selector/sender format.
4. Migration hits `invalid selector` or `invalid msg.sender` and exits; filtering the entry later fails the `unknown storage slot in state` check.
**How found:** Code review of the migration's withdrawal parsing checks against the public passMessageToL1 function; noticed the format assumptions were unenforced on-chain, then confirmed a real transaction on Optimistic Etherscan had already sent a direct message to the MessagePasser.
**Exploitation:** Attacker submits a single transaction directly to the LegacyMessagePasser predeploy with arbitrary message bytes; the resulting storage slot is recorded in the withdrawal dump but cannot be parsed, halting migration and forcing the Optimism team to unwind and rebuild the migration process.
**Insight:** When auditing migration/export tooling, check whether off-chain parsers assume an on-chain invariant (caller, selector, encoding) that the target contract does not actually enforce; any permissionless entrypoint writing to the same state can poison the dataset.