First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Signers can steal all the token with `withdrawTokensToL1` in L1BossBridge

n0kto

Summary

The withdrawTokensToL1 function in the smart contract allows any signer to withdraw tokens from the vault to a specified address. This can lead to unauthorized withdrawal of tokens by malicious signers.

Vulnerability Details

The vulnerability lies in the withdrawTokensToL1 where the abi.encodeCall is used to construct a call to the transferFrom function of the token contract. However, the transferFrom call is made with the vault as the from address, and an arbitraryto address specified by the signer. This allows any signer to transfer tokens to an address of their choice, potentially stealing the user's tokens.

Foundry (put in test file) PoC :

function testSignersStealTheVaultPoC() public {
// user send money to the bridge
testUserCanDepositTokens();
​
// withdraw to the operator address (steal user's money)
vm.startPrank(operator.addr);
(uint8 v, bytes32 r, bytes32 s) = _signMessage(
_getTokenWithdrawalMessage(operator.addr, 10e18),
operator.key
);
tokenBridge.withdrawTokensToL1(operator.addr, 10e18, v, r, s);
​
// Check the success of the steal
assertEq(token.balanceOf(operator.addr), 10e18);
​
// Give back money because we are white hats, not sneaky thief.
​
token.transfer(address(vault), 10e18);
assertEq(token.balanceOf(operator.addr), 0);
vm.stopPrank();
}

Impact

Loss of all funds : Any signers who sign a withdrawal to their accounts can steal all the money

Tools Used

Manual review

Recommendations

To fix this vulnerability, the withdrawTokensToL1 function should be modified to define, thanks to blockchain automation (and oracles), the to parameter without the need of a signer or any other user. This will ensure that tokens are transferred from the vault to the user who ask for a withdraw, preventing unauthorized withdrawals.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

depositTokensToL2(): abitrary from address

n0kto Submitter
almost 2 years ago
0xnevi Lead Judge
almost 2 years ago
n0kto Submitter
almost 2 years ago
0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

withdrawTokensToL1(): No check for deposits amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.