# Malicious actor can prevent migration by calling a non-existing function in `OVM_L2ToL1MessagePasser` and making `ReadWitnessData` return an error

Any call to OVM_L2ToL1MessagePasser is dumped as witness data; a call to a nonexistent function makes ReadWitnessData error and halts migration.

- Payout: Contest reward
- Severity: medium
- Program: Optimism
- Credited: 0xdeadbeef
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-optimism-judging/issues/67
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:go technique:source-review vuln:dos vuln:misconfiguration

**Target:** l2geth state dumper and op-chain-ops crossdomain witness parser
**Root cause:** The state dumper records all calldata sent to OVM_L2ToL1MessagePasser regardless of selector, but ReadWitnessData abi.MethodById/Unpack errors on unknown selectors and bubbles the error up, aborting migration.
**Steps:**
1. Call OVM_L2ToL1MessagePasser with calldata whose first 4 bytes are not a valid ABI selector (e.g. `0xdeadbeef`)
2. State dumper writes `MSG|<source>|<calldata>` to witness file
3. Run migration; ReadWitnessData calls `abi.MethodById(msgB[:4])` which fails
4. Error bubbles up and migration halts until witness data is cleaned
**How found:** Noticed the dumper writes calldata unconditionally while the parser assumes valid ABI selectors, creating a mismatch between collection and parsing.
**Exploitation:** Attacker submits a transaction to the message passer with arbitrary non-ABI calldata; the dumped witness entry causes the migration parser to error before any filtering, blocking the migration.
**Insight:** When a data collector and its downstream parser disagree on validation strictness, look for inputs the collector accepts but the parser rejects; here any non-ABI calldata poisons the migration file.