PoC for withdrawTokensToL1 not pausable vulnerability

Summary

The L1BossBridge::withdrawTokensToL1 function does not implement the pausable modifier.

Vulnerability Details

The L1BossBridge contract inherits OZ's Pausable utility but it is not implemented to the withdrawing function.
In "the event of an emergency", the owner can pause the protocol.
Though the known issue of a possible untrustful signer can arise. In this case, which would be an emergency, the owner would pause the bridge in order to secure the funds.
The withdraw function would not be paused though, leaving the tokens are risk of drain by the hack.

Impact

High impact: because funds are directly at stake.
Medium likelyhood: because the signers have to be set by the owner, suggesting that the probability of them being malicious is low. Still, we set it to medium because there is not hardcoded mechanism to prevent that risk.

Tools Used

Forge
Code rewiewing
Slither

Recommendations

Add the following modifier in L1BossBridge::withdrawTokensToL1 function.