First Flight #4: Boss Bridge

Summary

Function sendToL1 is public and allows arbitrary address to be called with any data, sending any amount of ether, given the message is signed by a valid signer.

Vulnerability Details

Function sendToL1 accepts arbitrary bytes memory message and as long as it is signed by a valid signer, the function extracts from the message a target address, value in wei and bytes memory data which could represents a function call relevant for the given target.
In the case in which sendToL1 is called by withdrawTokensToL1 the message is OK as it is hardcoded in the withdrawTokensToL1 function.

Best case scenario - this is unintended usage of the function.

Worst case scenario - contract can be drained out of Ether (if it has some for whatever reason).

Impact

Unintended feature, potential loss of value.

Tools Used

Manual code review and automated test

Recommendations

Make the function private or even better if it is deleted and its logic is moved to function withdrawTokensToL1(...) along with the modifiers.