Submission Details
Severity:
Authorization Bypass on Withdrawals
Summary
Anyone can withdraw funds from bridges by calling withdraw and unstakeEth.
Vulnerability Details
withdraw and unstakeEth do not check for any form of authorization. Any address can withdraw funds from a bridge.
For example:
function withdraw(address bridge, uint88 amount) external {
// No auth check
IBridge(bridge).withdraw(msg.sender, amount);
}
Impact
Attackers could drain bridge funds.
Tools Used
Manual
Recommendations
Add an access control check in withdraw and unstakeEth to restrict access.
For example:
modifier onlyAllowed() {
require(isAuthorized[msg.sender], "Not allowed");
_;
}
function withdraw(
address bridge,
uint88 amount
) external onlyAllowed() {
// ...
}
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.