Satanic_angel - _queueIndex is never emptied, so it can become quite large thus type-casting it to uint64 can lead to overflow

[sherlock-admin4]

Satanic_angel

Medium

_queueIndex is never emptied, so it can become quite large thus type-casting it to uint64 can lead to overflow

Summary

typecasting of _queueIndex variable in QueueTransaction event in the L1MessageQueueWithGasPriceOracle.sol file can lead to overflow of the value thus leading to invalid queue data

Root Cause

 function _queueTransaction(
        address _sender,
        address _target,
        uint256 _value,
        uint256 _gasLimit,
        bytes calldata _data
    ) internal {
        // compute transaction hash
        uint256 _queueIndex = messageQueue.length;
        //
        bytes32 _hash = computeTransactionHash(_sender, _queueIndex, _value, _target, _gasLimit, _data);

        messageQueue.push(_hash);

        // emit eventoverflow
        emit QueueTransaction(_sender, _target, _value, uint64(_queueIndex), _gasLimit, _data);
    }

QueueTransaction event has typecasting of uint256 to uint64 which can lead to overflow of the index values thus leading to invalid queue data for the Sequencer

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Invalid queue value can lead to invalid sequencer functioning thus leading to failure in bridging of the values and stuck of funds

PoC

No response

Mitigation

Do not typecast to uint64