Submission Details
Severity:
L1BossBridge.sol#depositTokensToL2 - Malicious user can deposit someone else's token
Summary
The contract allows an attacker to steal user's token after contract approval
Vulnerability Details
The user-controlled input from is not checked if the msg.sender is the from
Impact
A user who has approved this contract and a malicious user can input the user's address as the `from parameter and thereby steal funds from them, which he can then withdraw to himself
Tools Used
Manual Analysis
Recommendations
use msg.sender in place of from
Updates
Lead Judging Commences
0xnevi about 2 years ago
Submission Judgement Published Assigned finding tags:
depositTokensToL2(): abitrary from address
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.