First Flight #4: Boss Bridge

Summary

The L1BossBridge contract lacks recording of used signatures in the sendToL1 function, allowing potential misuse of the same message for multiple transactions.

Vulnerability Details

In the sendToL1 function, there is no restriction on the message, enabling a user to repeatedly trigger the function with the same message, leading to multiple token transfers from L2 to L1.

Impact

Exploiting this vulnerability enables users to accumulate more tokens on the bridge than initially deposited by reusing the same message.

Tools Used

Manual Review

Recommendations

To mitigate this issue, consider implementing one or both of the following:

1. Update the signers mapping value to false when a user withdraws the token.

2. Include a nonce value in the signing message and validate the nonce to prevent signature replay attacks.