First Flight #4: Boss Bridge

Summary

sendToL1 function is set to public so any valid signer can call it.
As there is no check regarding the message passed in the parameter of this function, it could be used to execute unexpected functions.

Vulnerability Details

The function withdrawTokensToL1 is an external function used by a signer to withdraw token. It calls the function sendToL1 by encoding the transferFrom function.

Anyway the sendToL1 function is a public function which could be called directly. It just checks that the signature was done by an authorized signer, so a signer could call it directly by encoding any other function which is a securoty breach

Impact

A signer could call directly the sendToL1 function to call any other functions other than transferFrom which is a security breach.

Tools Used

No tools used. It was discovered through manual inspection of the contract.

Recommendations

The function sendToL1 should be set to private to aviod being called directly. Probably it ould make sense Also does it make sense to have 2 functions