feat(protocol): restrict receive()'s msg.sender to vaults (#13110)

taikoxyz · Feb 9, 2023 · 2d8fa12 · 2d8fa12
1 parent eeb3a0e
commit 2d8fa12
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/packages/protocol/contracts/bridge/Bridge.sol b/packages/protocol/contracts/bridge/Bridge.sol
@@ -48,7 +48,11 @@ contract Bridge is EssentialContract, IBridge {
 
     /// Allow Bridge to receive ETH from the TokenVault or EtherVault.
     receive() external payable {
-        // TODO(dave,PR#13110): require the sender is the TokenVault or EtherVault
+        // Ensure the sender is either the Ether vault or the token vault.
+        require(
+            msg.sender == this.resolve("token_vault", false) ||
+                msg.sender == this.resolve("ether_vault", true)
+        );
     }
 
     /// @dev Initializer to be called after being deployed behind a proxy.