First Flight #4: Boss Bridge

Summary

In L1BossBridge.sol the vulnerability involves a lack of nonce tracking in the withdrawTokensToL1 and sendToL1 functions, allowing a malicious user to repeatedly execute the withdrawal mechanism until the tokens in the L1Vault are exhausted.

Vulnerability Details

Impact

Malicious user can call this function repeatedly with the same values ​​until the funds on L1Vault run out.

Tools Used

Manual review.

Recommendations

Implement a nonce tracking mechanism for withdrawal operations. Introduce a nonce parameter in the withdrawal functions to track and validate each withdrawal request, ensuring that only unique and authorized requests are processed.