Submitted by xiaoming90
Assume this is a fast-transfer path and the sequencer has a good reason (e.g. some sophisticated liquidity load balancing algorithm) to assign 3 routers to provide liquidity for a transfer of 90 DAI
Therefore, each of them will provide 30 DAI equally.
However, a malicious relayer could rearrange the _args.routers[] array to any of the following and still pass the sanity checks within BridgeFacet._executeSanityChecks
The point is that as long as the attacker ensures that the pathLength is correct, he will be able to pass the router check within BridgeFacet._executeSanityChecks.
Assume that malicious relayer decided to rearrange the _args.routers[] array to as follows, this will cause Router A to provide more liquidity than it should be and overwrite the sequencer decision. In this case, Router A will be forced to provide 90 DAI.
This is possible because the routerHash used to generate the router signature only consists of two items (transferId and pathLength)
BridgeFacet.sol#L636
Malicious relayer could overwrite sequencer decision, or cause a certain router to drain more liquidity than it should be.
Generate the routerHash with the following items should help to prevent this attack:
In this case, if the attacker attempts to re-arrange the  _args.routers[] array, the routerHash generate on the bridge will be different. Thus, it will fail the router signature verification within _executeSanityChecks function and it will revert.
jakekidd (Connext) disagreed with severity
jakekidd (Connext) acknowledged and commented:
0xleastwood (judge) commented:
