First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

nrestricted Access and Unauthorized Transfers in `L1BossBridge's` `depositTokensToL2` Function

maanvad3r

Summary

A critical security vulnerability has been identified in the depositTokensToL2 function of the L1BossBridge smart contract. This function currently allows any user to initiate a token deposit on behalf of any other address without requiring proper authorization. This flaw can be exploited by malicious actors to transfer tokens from any address to their own account on Layer 2 (L2), potentially leading to unauthorized token transfers and financial loss for affected users.

Vulnerability Details

The function lacks necessary checks to confirm that the caller (msg.sender) has the authority to move tokens from the from address. This oversight allows an attacker to use the depositTokensToL2 function to deposit tokens from any user's address into an L2 address of their choice, without the token owner's consent.

Impact

  • Unauthorized Token Transfers: This vulnerability allows attackers to redirect token deposits to their own L2 addresses, effectively stealing tokens from other users.

  • Loss of User Trust: Such vulnerabilities can significantly undermine the credibility and security perception of the token bridge, causing potential long-term damage to user trust.

  • Financial Risks: Users are at risk of financial losses due to unauthorized token movements.

Tools Used

  • Manual Review

  • Foundry

Recommendations

To mitigate this vulnerability, the depositTokensToL2 function should be modified to include a check ensuring that the caller is authorized to use tokens from the from address. This can be implemented as follows:

function depositTokensToL2(address from, address l2Recipient, uint256 amount) external whenNotPaused {
require(msg.sender == from, "Unauthorized: Caller must be token owner");
​
if (token.balanceOf(address(vault)) + amount > DEPOSIT_LIMIT) {
revert L1BossBridge__DepositLimitReached();
}
token.safeTransferFrom(from, address(vault), amount);
​
emit Deposit(from, l2Recipient, amount);
}
​
​
Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): abitrary from address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.