First Flight #4: Boss Bridge

Summary

The vulnerability exists due to the absence of an event trigger in the sendToL1 function, potentially leading to discrepancies between actions performed on L1 and corresponding events triggered on L2, causing inconsistencies in cross-chain actions. Within the sendToL1 function, there's no event emitted upon execution. As a result, the off-chain mechanism monitoring events on L1 and executing actions on L2 may not be synchronized properly.

Vulnerability Details

Impact

For example, if a user withdraws tokens on L1, the corresponding balance change might not reflect on their L2 account due to the lack of emitted events to signal L2 actions.

Tools Used

Manual review.

Recommendations

Implement the following lines of code:

'''solidity
event Withdraw(v, r, s, message);
'''
And within the sendToL1 function:
'''solidity
emit Withdraw(v, r, s, message);
'''