# Stale inflationMultiplier in L1ECOBridge

L1ECOBridge uses a stale cached inflationMultiplier instead of the live ECO token value, letting depositors receive more L2 tokens than deposited.

- Payout: Contest reward
- Severity: high
- Program: Ecoprotocol
- Credited: 0xRobocop
- Disclosed: 2023-05-08
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-ecoprotocol-judging/issues/126
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-ecoprotocol%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** L1ECOBridge cross-domain token bridge (Solidity)
**Root cause:** inflationMultiplier is cached and only refreshed by a separate rebase() call; _initiateERC20Deposit and finalizeERC20Withdrawal use the cached value while the ECO token applies its own live multiplier during transferFrom/transfer.
**Steps:**
1. Observe L1 ECO token's getPastLinearInflation(block.number) has increased but L1ECOBridge.rebase() has not been called, so bridge inflationMultiplier is stale/lower.
2. Call _initiateERC20Deposit: `IECO(_l1Token).transferFrom(_from, address(this), _amount)` moves _amount*realMultiplier gons, but bridge records `_amount = _amount * inflationMultiplier` with the stale lower multiplier.
3. On L2, minted amount is derived from the recorded gons, yielding more L2 ECO than the gons actually deposited.
4. Symmetrically, finalizeERC20Withdrawal divides _gonsAmount by stale inflationMultiplier, overpaying on withdrawal.
**How found:** Code reading: noticed inflationMultiplier is only updated in a separate rebase() transaction, while transferFrom in _initiateERC20Deposit applies the token's live multiplier before the cached value is used, creating a desync window.
**Exploitation:** Attacker waits for a rebase to occur on the ECO token without the bridge's rebase() being called, then deposits; the bridge under-records gons relative to what transferFrom actually moved, so the L2 mint credits more tokens than deposited, extracting value.
**Insight:** When a bridge caches a rebasing token's multiplier, check whether the token applies its own live multiplier during transferFrom/transfer — any cached-vs-live mismatch between the transfer and the accounting line is exploitable by timing deposits around rebases.