Call of safeTransferFrom with an address passed as a parameter
Summary
In function depositTokensToL2 the transfert of token is done from an arbitrary address provided as a parameter of the function
Vulnerability Details
The function safeTransferFrom used in depositTokensToL2 allows a user to deposit tokens in the vault. The address from which the token are transferred is an address provided as a parameter of the function depositTokensToL2.
It is then possible for anyone to call the depositTokensToL2 function with a from address from anyone who has approved the L1BossBridge contract to spend his token.
Impact
It is then possible for anyone to call the depositTokensToL2 function with a from address from anyone who has approved the L1BossBridge contract to spend his token.
Tools Used
slither
Recommendations
Use msg.sender as from in safeTransferFrom.
Lead Judging Commences
depositTokensToL2(): abitrary from address
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.