First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Malicious user could DOS to prevent sendToL1 function from ever working

atoko

Summary

DOS attack that could prevent the sendToL1 function from ever working

Vulnerability Details

the function contains a data parameter that could be manipulated by an attacker to make sure the function always reverts

(address target, uint256 value, bytes memory data) = abi.decode(message, (address, uint256, bytes));
​
(bool success,) = target.call{ value: value }(data);
if (!success) {
revert L1BossBridge__CallFailed();
}

Impact

if the data is manipulated by the attacker, they can make sure that the function always fails and reverts by doing so the function will always revert due to inaccurate data there by denying your users this service

Tools Used

manual review

Recommendations

add a parameter validation to ensure that the target is a valid contract and the data passed is verified so that you have control of the data that can be passed

Updates

Lead Judging Commences

0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

sendToL1(): Wrong function visibility

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.