First Flight #4: Boss Bridge

Summary

• sendToL1() parses an arbitrary set of bytes to obtain address target.

• This value is then used in a call().

• However it is possible for target == address(0), which would result in the value sent with the call() being lost.

Vulnerability Details

address(0).call() will always succeed, and the funds will be burned.

Impact

Loss of funds.

Tools Used

Manual inspection.

Recommendations

Revert with an error if target == address(0) before executing target.call().