First Flight #4: Boss Bridge

Summary

The constructor of the L1BossBridge contract sets an unlimited approval amount from the L1Vault to the L1BossBridge. This poses a substantial risk if the bridge contract is compromised, enabling an attacker to drain the vault.

Vulnerability Details

The constructor uses vault.approveTo(address(this), type(uint256).max) granting the bridge contract unrestricted access to the vault's funds. This is hazardous as it centralizes trust in the bridge's security.

Impact

Potential Total Fund Drain: If the bridge contract is exploited, the attacker could transfer all the funds from the vault.

Increased Attack Incentives: Knowing the bridge has unlimited access might attract more attackers.

Tools Used

Manual Review

Recommendations

Limit Approval Amounts: Change the approval strategy to a more controlled limit based on expected usage.