setFxChildTunnel Does Not Update l2TargetDispenser in PolygonDepositProcessorL1.sol (Potential Message Loss) about 2024-05-olas-findings

[kupermind]

The setFxChildTunnel() function is overridden such that it's ownable. The protocol is not the enemy to itself an will call the setL2TargetDispenser() function right away to set both fxChildTunnel and l2TargetDispenser variables correctly in one shot. After that, the owner is set to a zero address.

Take a look at the corresponding tests, they all call the correct setL2TargetDispenser() function and have messages sent as expected.

[c4-sponsor]

kupermind (sponsor) disputed

[c4-judge]

0xA5DF changed the severity to QA (Quality Assurance)

[0xA5DF]

Requires an admin error to happen - therefore low
Making setFxChildTunnel() public is indeed a bit odd, but I guess it's there due to the need to override the parent function

[c4-judge]

0xA5DF marked the issue as grade-c

[0xA5DF]

Closing as this is the only QA by the warden