First Flight #4: Boss Bridge

Summary

The protocol will be deployed on both Ethereum and ZKSync. The identified issue pertains to the possibility of unauthorized transactions occurring across different chains due to signature replay. To mitigate this concern, it is essential to incorporate the respective chain's ID into the signed data, in order to prevent signature reuse on distinct chains.

Vulnerability Details

Potential unauthorized transactions via signature replay across different chains.

Impact

Unauthorized execution of transactions on different chains due to signature replay, potentially leading to financial losses or misbehavior

Tools Used

• Manual review

Recommendations

Ensure that the signed data includes the chain ID where it should be executed to prevent signature reuse on different chains.