First Flight #4: Boss Bridge

Summary

A signature replay attack is possible on the function sendToL1.

Vulnerability Details

The signature passed to the sendToL1 is publically visible once it is submitted in a transaction and hence it can be used multiple times to drain the vault.

Impact

Draining complete vault tokens. The user can transfer all the vault tokens to itself resulting in loss of user funds.

Tools Used

forge

Recommendations

To add nonce to the message that is signed by the bridge operator and check that nonce while verifying the signature since the ECDSA library is only used to recover the signer and message, it does not check the uniqueness of the signature.