Submitted by ether_sky, also found by nobody2018 and jasonxiale
All branches have one core router and several subsidiary branches. The core branches handle system calls, and users can create deposits using subsidiary branches. The function utilized for creating deposits is the callOutAndBridge function. However, in the Arbitrum branch, this function is not available for use. This restriction has system-wide implications because the Arbitrum branch should function similarly to other local branches.
When a user attempts to make a deposit in other branches, the local hTokens are transferred from the user to the local branch port and subsequently burned.
However, in Arbitrum, there is no differentiation between local and global hTokens. Consequently, they are sent directly to the root port.
When a user invokes the callOutAndBridge function in a branch, it involves the transfer of hTokens and underlying tokens from the user to the router. Additionally, the router approves the local port to access and utilize these tokens.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BaseBranchRouter.sol#L95
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BaseBranchRouter.sol#L167-L168
Then we call the callOutAndBridge function within the bridge agent. Within this function, a deposit is created. 
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L224
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L824
Weve now reached the _bridgeOut function in ArbitrumBranchPort. 
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/ArbitrumBranchPort.sol#L134
Here, the _depositor is the router, and ArbitrumBranchPort is authorized to access these tokens, but not RootPort. 
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootPort.sol#L301
Consequently, we are unable to bridge these tokens to the RootPort from _depositor.
Add test below to test/ulysses-omnichain/ArbitrumBranchTest.t.sol and run test. You can see that the test will fail:
Change this:
to:
You can observe that the test will pass successfully. Its important to note that when users attempt to use the callOutAndBridge function within the bridge agent, they allow the local port to access their funds, just as in other branches.
Token-Transfer
0xLightt (Maia) confirmed
0xBugsy (Maia) disagreed with severity
alcueca (judge) decreased severity to Medium and commented:
alcueca (judge) commented:
0xBugsy (Maia) commented:
