Submitted by ktg, also found by 0x52
EthereumToArbitrumRelayer.sol#L118-#L127
When someone wants to make  calls to Arbitrum from Ethereum, first they call relayCalls to fingerprint their data and then anyone else can call processCalls to process the calls. According to the doc in Inbox source code https://github.com/OffchainLabs/nitro/blob/1f32bec6b9b228bb2fab4bfa02867716f65d0c5c/contracts/src/bridge/Inbox.sol#L427, function createRetryableTicket has one parameter called callValueRefundAddress and this is the address that is granted the option to cancel a Retryable. In EthereumToArbitrumRelayer.sol its currently set as msg.sender (5th parameter) which is whoever make the call to  function processCall:
This implementation allows an attacker to remove the possibility of a user to cancel their calls, which is an important mechanism to be properly implemented. This scenario demonstrates how this could happen:
It should be noted here that EthereumToArbitrumRelayer.sol provides no other functionality to cancel userss calls, but it seems to rely only on Arbitrums Retryable cancel mechanism to do so.
Currently, anyone can process otherss calls by calling processCalls functions and I think this does not pose any security risk as long as the user who actually fingerprinted these calls can reserve their rights to cancel it if they want to. Therefore, I recommend changing callValueRefundAddress in createRetryableTicket to _sender, this combines with event ProcessedCalls(_nonce, msg.sender, _ticketID) emitted at the end of processCalls function will allow a user to be notified if their calls has been processed by anyone else and they can cancel it in L2 using _ticketID.
Alex the Entreprenerd (judge) commented:
PierrickGT (PoolTogether) confirmed and commented:
Alex the Entreprenerd (judge) commented:
Alex the Entreprenerd (judge) commented:
