First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unprotected call to a function sending Ether to an arbitrary address.

imth3ak

Summary

function called sendToL1 that sends Ether to an arbitrary address based on a signed message. The function is vulnerable to a dangerous call that could allow an attacker to withdraw unauthorized funds from the contract.

Vulnerability Details

Source Link:- https://github.com/Cyfrin/2023-11-Boss-Bridge/blob/dad104a9f481aace15a550cf3113e81ad6bdf061/src/L1BossBridge.sol#L121

(bool success,) = target.call{ value: value }(data);

Impact

The impact of the above issue is that the function sendToL1 could be exploited by an attacker who can create a fake signed message that instructs the contract to send Ether to their own address. This could allow the attacker to drain the funds from the contract and cause a loss of Ether for the legitimate users. Therefore, it is important to protect the function from dangerous calls that could send Ether to an arbitrary address.

Tools Used

  • slither

  • foundry

Recommendations

the recommendation is to add a modifier to the function that checks if the target address is a whitelisted one. For example, you can create a mapping of addresses that are allowed to receive Ether from the contract, and then use a modifier like this:

// Mapping of whitelisted addresses
mapping(address => bool) public whitelist;
​
// Modifier that checks if the target is whitelisted
modifier onlyWhitelisted(address target) {
require(whitelist[target], "L1BossBridge__NotWhitelisted");
_;
}
​
// Add the modifier to the function
function sendToL1(uint8 v, bytes32 r, bytes32 s, bytes memory message) public nonReentrant whenNotPaused onlyWhitelisted(target) {
// Rest of the function
}
Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

sendToL1(): Wrong function visibility

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.