Summary

Vulnerability Details

The bridge contract is to be deployed as upgradeable contracts, however this isn’t done properly.
For OpenZeppelin contracts used within upgradeable contracts It is required to use the Upgradeable variant of OpenZeppelin Contracts. This is stated in the docs in multiple places:
Using with Upgrades - https://docs.openzeppelin.com/contracts/5.x/upgradeable
Writing Upgradeable Contracts - https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#storage-gaps
Potential issues are the Lack of storage gaps in these library contracts, as well as checks for storage incompatibilities across minor versions, all of which have been added and done by open zeppelin.

Tools Used

Manual Review

Recommendations

Use upgradeable contracts for ownable, Context