First Flight #4: Boss Bridge

Summary

• sendToL1() has bytes memory message parameter.

• A caller can send an arbitrary number of bytes via this parameter.

• This leads to unbounded gas costs.

Vulnerability Details

• A bytes memory to a function is allocated by the EVM.

• Memory access via memory expansion has a quadratic increase in cost for each subsequent offset.

Impact

• An attacker can cause a signed transaction to consume arbitrary amounts of gas. This can be used to create a denial of service whereby transactions always run out of gas.

Tools Used

Manual inspection.

Recommendations

• sendToL1() should only accept a fixed size message.