T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/relay-bridge.js:90
- Finding
- Bridge Script Sends Mainnet ETH Without Destination Routing Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/relay-bridge.js:90-99` **Vulnerability Type**: Unsafe bridge transaction construction **Risk Level**: High ### Vulnerable Code ```javascript // Relay uses a simple deposit to their contract // The Relay API handles the rest console.log(`\nSending to Relay depositor: ${chain.relayDepositor}`); const tx = await wallet.sendTransaction({ to: chain.relayDepositor, value: amountWei, data: "0x" // Simple ETH transfer }); ``` ### Technical Analysis The script claims to bridge ETH to Abstract, but it does not request a bridge quote or transaction from Relay, submit destination-chain parameters, encode the destination chain ID, or explicitly provide the destination recipient. Instead, it sends a plain ETH transfer with empty calldata to a hard-coded address. The comment states that the Relay API handles the remainder, but the implementation does not call a Relay API. A confirmed source-chain transaction therefore establishes only that ETH was transferred to the configured address; it does not prove that a valid route to Abstract was created. The script then reports the source transaction as a successful deposit and states that Relay will bridge it, without verifying destination-chain settlement. ### Attack Path 1. A user follows the bridge instructions in `SKILL.md` and exports a funded private key. 2. The user runs `relay-bridge.js` with a source chain and amount. 3. The script constructs a plain ETH transfer to the configured hard-coded address. 4. No route, quote, destination recipient, destination chain, or bridge-specific calldata is obtained or validated. 5. The source transaction confirms, and the script reports success. 6. The transferred ETH may not arrive on Abstract and may be difficult or impossible to recover. ### Impact Assessment The affected privilege is the signing authority of the wallet supplied through `WALLET_PRIVATE_KEY`. The scope is the amount submitted by each invoca ...[truncated 363 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Obtain the bridge transaction from Relay's documented quote or transaction API rather than constructing a plain ETH transfer. 2. Explicitly supply and validate: - Source chain ID. - Destination chain ID `2741`. - Source and destination tokens. - Destination recipient. - Input amount and expected output amount. 3. Validate the API response before signing: - Confirm the transaction target is an approved Relay contract. - Confirm the returned chain ID matches the selected source chain. - Confirm the transaction value equals the approved amount. - Reject empty or unexpected calldata unless the official protocol specification explicitly requires it. 4. Display the complete route, fees, recipient, minimum output, and target contract and require explicit user confirmation. 5. Verify the provider-reported chain ID before sending. 6. Report source submission and destination settlement as separate states. Do not report a completed bridge until the destination transaction or balance change has been verified. 7. Add testnet integration tests and small-value route tests before enabling mainnet by default. ]]>