First Flight #4: Boss Bridge

Summary

A potential issue within the smart contract related to the use of the withdrawTokensToL1 function. Specifically, the absence of the proper utilization of the amount parameter within the abi.encode function call seems to result in a static 0 value being implied for the transaction's value field. This will lead to the function being broken.

Vulnerability Details

´´´

function withdrawTokensToL1(
    address to,
    uint256 amount,
    uint8 v,
    bytes32 r,
    bytes32 s
) external {
    sendToL1(
        v,
        r,
        s,
        abi.encode(
            address(token),
            0, // value
            abi.encodeCall(
                IERC20.transferFrom,
                (address(vault), to, amount)
            )
        )
    );
}

´´´

The vulnerability lies in the withdrawTokensToL1 function, where the abi.encode usage includes a comment suggesting 0 // value as a placeholder for the value parameter. However, the amount parameter is not being used as the value in the encoded transaction data, potentially resulting in a static 0 value being transmitted with the transaction.

Impact

The current state of the function could cause transactions initiated by withdrawTokensToL1 to inadvertently send a value of 0 instead of the intended amount of tokens.

Tools Used

Manual inspection

Recommendations

Modify the abi.encode function within the withdrawTokensToL1 method to correctly utilize the amount parameter as the value to be sent with the transaction.