First Flight #4: Boss Bridge

Summary

We can steal any token approved by any user to the L1BossBridge contract by transferring it to the bridge and minting it on the L2.

Vulnerability Details

The depositTokensToL2(...) function takes in a from, l2Recipient and amount parameter. In the function body a safeTransferFrom(...) call is made to the token, where amount funds are transferred from the specified from address to the vault. An attacker is able to specify this from address as a function argument. A Deposit event is then emitted by the contract indicating a successful deposit, where the l2Recipient is then permitted to mint the token on the L2. As a result of this an attacker can specify any from address for a user that has previously approved token (and other tokens when they are added) to be spent by the L1BossBridge contract, and set him/herself as the l2Recipient. In doing so stealing funds of the user on the L1 side and minting it to the attacker on the L2 side.

Impact

Loss of funds for any user approving the L1BossBridge to spend funds on the L1.

Test:

Logs:

Significant traces:

Tools Used

Manual review
Foundry

Recommendations

Remove the from parameter and change token.safeTransferFrom(from, address(vault), amount); to token.safeTransferFrom(msg.sender, address(vault), amount);