Missing protection against Cross-chain signature replay attacks, Same signature can be used multiple times
The problem with the code is; in the message that is recovered there is nothing that can be used to prevent the same signature to be used multiple times.
Because the transaction containing the signature values is publicly visible on the blockchain, an attacker can copy the signature and submit identical withdraw calls, draining the bridge contract.
High
Manual Review
Cross-chain replay attacks can be prevented by implementing a nonce, a number that is only used once, into the signing and verification process, because this contract will also be deployed on L2 adding the chain ID into the signing and verification process is also recommended
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.