First Flight #4: Boss Bridge

Summary

setSigner() does not have the whenNotPaused modifier.

Vulnerability Details

When the contract is paused, the owner should not be able to continue adding/removing allowed signers from the contract. If an off-chain service signer already picked up a deposit and is waiting for the bridge to be unpaused to send a signed withdrawal, then if it is removed from the allowed signers list, it will make the transaction fail and potentially the account that was bridging tokens will not see the tokens bridged. Thus, creating panic for all users.

Impact

An account bridging may not receive his bridged tokens, thus creating panic for the protocol.

Tools Used

Manual review.

Recommendations

Add the correct modifier.