First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The contract uses an `onlyOwner` modifier for critical functions leading to centralization.

JCM

Summary

The L1BossBridge.sol contract uses an onlyOwner modifier for critical functions like pause, unpause, and setSigner. This centralizes control in the hands of a single entity, which could be a security risk if the owner's private key is compromised.

Vulnerability Details

This vulnerability exists in the L1BossBridge.sol pause, unpause, and setSigner functions starting on line 49.

These functions use the onlyOwner modifier, which means only the owner can execute these functions. This centralization creates a single point of failure.

// Here
function pause() external onlyOwner {
_pause();
}
​
function unpause() external onlyOwner {
_unpause();
}
​
function setSigner(address account, bool enabled) external onlyOwner {
signers[account] = enabled;
}
​

Considering implementing a multi-signature mechanism or a decentralized governance system would avoid this issue to happen.

Impact

If the owner's account is compromised, the attacker could pause the bridge, potentially disrupting service and causing financial loss.

Proff of Concept

Test case example with pause function.

function testPauseByOwner() public {
bridge.pause();
assertTrue(bridge.paused());
}
​
function testFailPauseByNonOwner() public {
bridge.transferOwnership(nonOwner);
bridge.pause();
}
}

Tools Used

  • Forge

Recommendations

Implement a decentralized control mechanism, such as a multi-signature wallet or a DAO, to manage these critical functions.

This is a simplified example with a multi-signature mechanism

- function pause() external onlyOwner {
+ function pause() external onlyMultiSigOwners {
_pause();
}
​
- function unpause() external onlyOwner {
+ function unpause() external onlyMultiSigOwners {
_unpause();
}
​
- function setSigner(address account, bool enabled) external onlyOwner {
+ function setSigner(address account, bool enabled) external onlyMultiSigOwners {
signers[account] = enabled;
}```
​
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.