Summary

A transaction calling withdrawTokensToL1() can be resent an arbitrary number of times. An attacker can drain all of the vault's funds.

Vulnerability Details

• withdrawTokensToL1() is a protocol function that is not secured by the networks on which the protocol runs. This means that the protocol has to implement logic to provide transactional security guarantees.

• withdrawTokensToL1() does not contain logic to identify individual transactions.

• Once a withdrawTokensToL1() is broadcast, an attacker has a valid signed bridge transaction and can then continuously rebroadcast the transaction and drain all the funds.

Impact

• Loss of funds from protocol vault.

Tools Used

Manual inspection.

Recommendations

• Include a transaction nonce in the signed message used by withdrawTokensToL1(). This nonce will uniquely identify each transaction.

• If a transaction has a nonce that is not newer than the latest nonce, then revert.