First Flight #4: Boss Bridge

Summary

The withdrawTokensToL1 function lacks reentrancy checks making the function vulnerable to reentrancy attacks

Vulnerability Details

since the function sendToL1 in the contract contains a call function, this is an external call and could introduce cross function reentrancy attacks

Impact

attacker could call the sendToL1 function and then call to the withdrawTokensToL1 function and exploit a reentrancy attack

Tools Used

manual analysis

Recommendations

consider adding reentrancy guards to all the functions that involve a change in state so that all the functions are safe from reentrancy risks, this means adding a reentrancy guard in the withdrawTokensToL1 function