Submitted by 0xito, also found by ElliotFriedman
Attacker can send a logic call that performs a token.approve(attackerAddress, type(uint256).max) using the submitLogicCall function.
Afterwards, they can steal all tokens from the bridge using token.safetransferfrom(bridge, attacker, amount).
Disallow calls to the bridge contract, or to any token/NFT contracts that the bridge owns tokens of (token.balanceOf(address(this)) > 0).
jkilpatr (Althea) disputed:
albertchon (judge) commented:
jkilpatr (Althea) commented:
