First Flight #4: Boss Bridge

Summary

L1BossBridge::sendToL1 allows authorized signers to make arbitrary calls, as the message param is decoded into a specific target and calldata.

Vulnerability Details

L1BossBridge::sendToL1 has a function parameter bytes memory message. The function uses this param to decode:

and finally use these parameters to make a low level call:

This function allows authorized signers to potentially steal users funds, if the target is the token address, and the data is:

Also, the target can be any ERC20 token address.

If the contract could hold ETH, if the target is the signer address, and the data is empty, this function will actually be used to send ether:

Basically, this function is intended to be used to withdraw tokens from L2 to L1, but its actually a risky function that lets authorized signers do as they please.

Impact

Medium. Although this is considered a centralization risk, this does not mean that its should not considered as a risk, because allowing authorized signers to make arbitrary calls should not be allowed.

Tools Used

• Manual Review

Recommendations

Remove withdrawTokensToL1 function and message param from sendToL1 function. Remove also the low level call. Make sure to only allow transferFrom from vault to msg.sender.