_Follow along with the video lesson:_ --- ### Exploit - Low-Level Arbitrary Call I'm going to just tell you, you've been doing great to get this far. We've got 2 more bugs we'll cover in this section, but we're going to go over them fairly quickly, I want to challenge you to go through these processes yourself. You've got to build these habits to become really good at them. > **Note:** There are _more_ bugs in this code base than we'll cover. Finding the bugs is a different skill from writing up the bugs and you've got to practice them both! > > The repo for this course has details on a few vulnerabilities we _don't_ cover for you to check your work! ### Following up with Slither Earlier in the review, we came across an issue detected by Slither in `L1BossBridge.sol`. Let's head back there and verify what's going on. ```js function sendToL1(uint8 v, bytes32 r, bytes32 s, bytes memory message) public nonReentrant whenNotPaused { address signer = ECDSA.recover(MessageHashUtils.toEthSignedMessageHash(keccak256(message)), v, r, s); if (!signers[signer]) { revert L1BossBridge__Unauthorized(); } (address target, uint256 value, bytes memory data) = abi.decode(message, (address, uint256, bytes)); // @Audit-Question: Slither detects an issue here, follow up (bool success,) = target.call{ value: value }(data); if (!success) { revert L1BossBridge__CallFailed(); } } ``` At the time, we didn't have enough context to know if this was actually bad or not. Slither detects this as a circumstance of [**`arbitrary-send-eth`**](https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations). **_What's this mean?_** The issue is that the `sendToL1` function is passing arbitrary `messages`. We're taking the user's word that they are sending the correct message data, calling an expected function, but this may not be the case! Remember the `L1Vault` has a function `approveTo`, which can only be called by the `L1BossBridge`. ```js function approveTo(address target, uint256 amount) external onlyOwner { token.approve(target, amount); } ``` Were a malicious actor to pass _this_ function data to the `sendToL1` message parameter, they could steal all the tokens in the vault! ### Wrap Up Alright, that's all I'm giving you! I challenge you to write this exploit into a finding and be sure to prove it with a Proof of Code. There's an example you can compare your work to, in the [**GitHub Repo**](https://github.com/Cyfrin/7-boss-bridge-audit/blob/audit-data/audit-data/2023-09-01-boss-bridge-audit.md). Please **_do not skip_** these exercises. These are the challenges that will take the training wheels off and ready you to perform security reviews yourself. I look forward to all the completed reports being shared!