First Flight #4: Boss Bridge

Summary

BossBridge can be spoofed to bypass onlyOwner modifier on L1Vault::approveTo().

Vulnerability Details

An attacker can send a tx to L1Vault, calling L1Vault::approveTo(). There is no filtering done on transactions sent by users in L1BossBridge::sendToL1. The message is sent from L1BossBridge which is the owner of L1Vault. Hence the attacker can impersonate L1BooBridge, and approve all tokens to an address the attacker controls, and then the attacker steals L1Vault's tokens.

Impact

All tokens can be stolen.

Tools Used

Manual review

Recommendations

Filter user transactions to restrict calls to sensitive functions and functions to which they are not entitled.