First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`sendToL1` can be call by anyone to force withdraw ETH to depositor

uint256vieet

Summary

sendToL1 can be call by anyone to force withdraw ETH to depositor

Vulnerability Details

  • Anyone can listen event emitted from blockchain about depositor deposit to L2

  • v,r,s also public to anyone so they just need encode those params to bytes32 message similar to the signer do when they receive Deposit event:

abi.encode(
address(token),
0, // value
abi.encodeCall(IERC20.transferFrom, (address(vault), to, amount))
)

  • After that, attacker can pass uint8 v, bytes32 r, bytes32 s, bytes memory message to the function sendToL1 to force withdraw to address of depositor
    event though the depositor not intent to do that

Impact

  • This Vulnerability make depositor being call withdraw to their wallet even though they don't intent to do that

Tools Used

manual review

Recommendations

Must check the caller of sendToL1 is the one that trigger depositor by decode message in to target, value, data
Decode data to IERC20.transferFrom, (address(vault), to, amount) than check if to equal to msg.sender to prevent the caller of sendToL1 is not the one who deposit but is trying to force call withdraw to depositor address even though the depositor not want to do that.

function sendToL1(uint8 v, bytes32 r, bytes32 s, bytes memory message) public nonReentrant whenNotPaused {
address signer = ECDSA.recover(MessageHashUtils.toEthSignedMessageHash(keccak256(message)), v, r, s);
(address target, uint256 value, bytes memory data) = abi.decode(message, (address, uint256, bytes));
+ (address vaultAddress, address receipient, uint256 amount) = abi.decode(data, (address, address, uint256));
+
+ require(
+ msg.sender == receipient, "The caller is not depositor but trying to force withdraw to depositor wallet"
+ );
if (!signers[signer]) {
revert L1BossBridge__Unauthorized();
}
​
(bool success,) = target.call{ value: value }(data);
if (!success) {
revert L1BossBridge__CallFailed();
}
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

sendToL1(): Wrong function visibility

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.