First Flight #4: Boss Bridge

Summary

The L1BossBridge contract is making a dangerous infinite approval from the vault to itself.

Vulnerability Details

The first thing is that is recommended to only make approvals for the necessary amounts and not for an infinite amount in case a contract is compromised.
But since Vault allows the bridge to modify the approval, the main issue comes from the fact that the approval is only done once in the constructor. If some tokens accepted by the vault have very big decimals, then uint256.max might not be enough of an approval.

Impact

In the very specific case where the uint256.max is not enough, the bridge would be bricked for the particular token.

Tools Used

Manual review.

Recommendations

Make approvals when necessary for the adequate amounts.