First Flight #4: Boss Bridge

Summary

With a valid withdraw signature, a user can call the withdrawTokensTol1 function mutliple times until they have drained the vault contract of its tokens.

Vulnerability Details

There are no checks to see if signature was used. Also there is no accounting for how much the user has deposited compared to how much the user can withdrawals.

Impact

Vault contract can be drained of all its funds using a recall attack causing a devasting loss of funds for the project and users.

Tools Used

Forge

Recommendations

Add checks and balances on users deposits vs withdraw. Also add in a signature validator which can check if the signature is valid or if it was already used.