First Flight #4: Boss Bridge

Summary

The bridge cannot receive ether, and as such cannot send ether via msg.value.

Vulnerability Details

The bridge has no payable functions, no receive nor fallback functions. As such it cannot hold any ether (unless another contract self-destructed and sent ether to the bridge which is like an impossible scenario). However, in sendToL1(), the off-chain service can instruct the contract to send ether to another contract which will not work since the bridge cannot hold ether ((bool success,) = target.call{ value: value }(data);).

Impact

sendToL1() will always fail when trying to specify how much ether to send to another contract via msg.value. The functionality is broken.

Tools Used

Manual review.

Recommendations

Add a fallback or receive function, or make sendToL1() payable.