First Flight #4: Boss Bridge

Summary

The sendToL1 function is vulnerable to Signature Replay Attack, since there is no check to see if the signature was used before or not.

Vulnerability Details

A Signature Replay Attack is a type of security vulnerability that occurs when an attacker captures a valid cryptographic signature and attempts to use it again to execute unauthorized actions. This can lead to unexpected behaviors in smart contracts, allowing the attacker to perform actions they are not authorized for.

Impact

In the provided sendToL1 function, the contract uses the ECDSA.recover function to recover the signer's address from the signature. However, the contract does not check if the signature has been used before. This means that an attacker could capture a validly signed transaction and replay it multiple times, resulting in unauthorized transfers of funds.

Tools Used

Manual Analysis and AI tool phind.

Recommendations

To prevent Signature Replay Attacks, you could incorporate a nonce and timestamp mechanism into your contract logic. A nonce is a unique identifier for each transaction, ensuring that each transaction can only be executed once. Additionally, using timestamps can add an extra layer of security by allowing contracts to reject transactions that are too old to prevent replay attempts.

Here's an example of how you could modify the sendToL1 function to include a nonce and timestamp:

Now in the updated code, the contract checks if the nonce has been used before and if the transaction is too old before it recovers the signer's address. After the transaction is executed, the contract marks the nonce as used. This prevents the same signature from being replayed.