Summary

A malicious signer can potentially withdraw all the funds to themselves as they have full control over the funds transfer and can drain all the funds from the vault. The bridge is meant to allow the user to deposit and withdraw their bridged funds, but it can misused by the signer to drain all the funds, as instead of calling transfer for the user, they can call it for themselves with the full amount inside the vault.

Vulnerability Details

• There is no mechanism inside L1BossBridge contract to track the withdrawal request being signed by signer actually exists or not due to which a malicious signer can sign for any withdrawal request that can be on their address and
  can potentially drain all the funds by signing the withdrawal message hash for themselves and drain all the funds from the Vault by calling L1BossBridge::withdrawTokensToL1 with their own signature containing the withdrawal request to send funds to their own address.

• Also, a malicious signer can call L1BossBridge::depositTokensToL2 and after successful withdrawal on L2, the signer can then withdraw the token that was deposited on L1 by approving the withdrawal request for themselves.

Impact

High. A malicious signer can drain all funds.

Tools Used

Manual Review, Foundry Test

PoC

Paste the below test in test/L1TokenBridge.t.sol and run the test: forge test --mt test_MaliciousSignerCanDrainAllFunds

Recommendations

When deposit is made on a layer 1 to bridge tokens to layer 2 or vice-versa, then a off-chain event is triggered, so consider adding a nonce with that event which will uniquely identify that particular bridge request and store that withdrawal request corresponding to the nonce, which will make sure that a txn being signed by a signer actually exists.
So, when the off-chain mechanism picks up the event mints the corresponding tokens on L2, along with that the particular withdrawal request should be stored on-chain.