Skip to content

Comments

Audit fix: CGT vs Lockbox.#418

Merged
Mc01 merged 2 commits intocelo-contracts/v4.1.0from
mc01/audit-4.1.0/cgt-lockbox
Feb 19, 2026
Merged

Audit fix: CGT vs Lockbox.#418
Mc01 merged 2 commits intocelo-contracts/v4.1.0from
mc01/audit-4.1.0/cgt-lockbox

Conversation

@Mc01
Copy link

@Mc01 Mc01 commented Feb 17, 2026

Fixes [M-01] OptimismPortal2#finalizeWithdrawalTransactionExternalProof - ETHLockbox Misaccounting With Custom Gas Token Withdrawals


Note

Medium Risk
Touches core deposit/withdrawal execution paths and configuration gating; mistakes could change lock/unlock behavior or break networks that rely on the lockbox feature.

Overview
Prevents ETHLockbox from being used on custom-gas-token (CGT) chains to avoid incorrect ETH accounting during deposits/withdrawals.

OptimismPortal2 now treats lockbox as active only when the gas-paying token is Constants.ETHER, SystemConfig.setFeature rejects enabling Features.ETH_LOCKBOX on CGT chains, and OPContractsManagerStandardValidator adds corresponding validation (including asserting lockbox incompatibility with CGT). New tests cover the feature-flag revert and that deposits on CGT chains never call ethLockbox.lockETH even if the flag/storage are force-enabled.

Written by Cursor Bugbot for commit 4b4d425. This will update automatically on new commits. Configure here.

@Mc01 Mc01 requested a review from pahor167 February 17, 2026 12:53
@Mc01 Mc01 merged commit f62faa2 into celo-contracts/v4.1.0 Feb 19, 2026
2 of 3 checks passed
@Mc01 Mc01 deleted the mc01/audit-4.1.0/cgt-lockbox branch February 19, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants