uint256 gasLimit,
uint256 maxFeePerGas,
uint256 nonce,
address to,
uint256 value,
bytes data,
+ address spoofedSender
) external returns (uint256 msgNum) {
whenNotPaused();
onlyAllowed(msg.sender);
require(data.length <= MAX_DATA_SIZE);
- address l1Sender = msg.sender;
- if (msg.sender.code.length > 0) {
- l1Sender = msg.sender + ALIAS_OFFSET;
- }
+ address l1Sender = spoofedSender - ALIAS_OFFSET;
bytes memory l2Payload = abi.encodePacked(
uint8(L2_MSG_unsignedEOATx),
gasLimit, maxFeePerGas, nonce,
uint256(uint160(to)), value, data
);
msgNum = bridge.enqueueDelayedMessage(
L1_MSG_L2Message,
l1Sender,
keccak256(l2Payload)
);
}
클로드가 뽑아준 임시 delayed inbox 내 변경부분 (0x9d262b76 함수)
클로드피셜 기존 sendUnsignedTransaction 함수에 L1 sender를 공격자 주소로 중간에 바꿔치기하는 로직을 넣어놨나보네요.