USDC bridger

[karacurt]

No description provided.

[octane-security-app]

Summary by Octane

New Contracts

• ERC20OrbitBridger.sol: ERC20OrbitBridger bridges ERC20 tokens to Orbit Chains, auto-calculating gas fees and ensuring no reentrancy.
• USDCOrbitBridger.sol: USDCOrbitBridger bridges USDC to Orbit Chain, calculates fees, and handles token transfers via a gateway and router.
• IERC20Bridge.sol: The smart contract facilitates bridging ERC20 tokens between L1 and L2, enqueues messages for sequencing, and includes token validation and initialization functions.
• IGatewayRouter.sol: The contract defines a gateway router interface for token transfers, managing token-gateway mappings, and emitting related events.
• IInboxBase.sol: A smart contract interface for an L2 messaging system, enabling message sending, transaction management, fee calculation, and access control via allowList.
• IL1ArbitrumGateway.sol: This smart contract facilitates ERC20 token deposits from Ethereum to Arbitrum, handling L1 to L2 messaging and custom gas refund management.

Updated Contracts

No contracts were updated in this PR.

---

🔗 Commit Hash: 1968a73

[octane-security-app]

Overview

Vulnerabilities found:	2
Severity breakdown:	1 Critical, 1 High

Detailed findings

web3/contracts/bridge/ERC20OrbitBridger.sol

• Review potential Missing Access Control issue that is exposed in the bridgeERC20 function

web3/contracts/bridge/USDCOrbitBridger.sol

• Review potential Frontrunning issue that is exposed in the bridgeUSDC function

---

🔗 Commit Hash: 1968a73
🛡️ Octane Dashboard: All vulnerabilities

[zomglings]

lgtm

[zomglings]

I was going to suggest calling it ERC20Bridger or SpecificERC20Bridger but actually I ended up really liking the name USDCBridger. It's not strictly speaking accurate since you can put any ERC20 token address there, but it works. :)

[zomglings]

@karacurt : Just add a clarification that it can be used to bridge any specific ERC20 token - not just USDC. This address must be passed during contract construction.

[zomglings]

This documentation is the same as that of ERC20Bridger. We should note here that, unlike ERC20Bridger, this contract is for a single ERC20 token, specified when the contract is deployed.

[zomglings]

lgtm