Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

Vulnerability

Overview

OpenZeppelin Contracts for Solidity includes cross-chain utilities for Arbitrum L2, specifically CrossChainEnabledArbitrumL2 and LibArbitrumL2. These utilities contain a flaw where direct interactions from externally owned accounts (EOAs) are incorrectly identified as cross-chain calls originating from L1, even though they are not. This incorrect classification can lead to unintended behavior in contracts that rely on these utilities to distinguish between L1-initiated and direct L2 interactions [1][4].

Exploitation

Scenario

The vulnerability can be exploited by any EOA that directly interacts with a contract using the affected utilities. The contract will treat the EOA's call as if it came through the Arbitrum bridge from L1, potentially granting the EOA privileges or access that should only be available to L1-originated calls. However, the advisory notes that any action an EOA can take by exploiting this issue could also be performed through the legitimate bridge, reducing the practical risk [4].

Impact

Assessment

If exploited, an attacker could bypass cross-chain authentication mechanisms, potentially leading to unauthorized state changes. The severity is assessed as low because the same actions could be performed through the intended bridge mechanism without the bug. Nevertheless, contracts that rely on strict separation between L1 and L2 callers may be vulnerable to logic errors [1][4].

Mitigation

The issue is fixed in OpenZeppelin Contracts version 4.7.2. Users are advised to upgrade to this version or later. No workarounds are available [1][4]. The fix was implemented in pull request #3578, which modifies the cross-chain detection logic to correctly identify EOA calls [3].