bridge-h01-exploit.sol

// Add test case into the Router suite
contract L1GatewayRouterTest is L1GatewayTestBase {

	// ...

	function testDropMessageRouter() public {
        uint256 amount = 100;
        uint256 gasLimit = 300_000;

        amount = bound(amount, 1, address(this).balance);

	// User calls the router to deposit ETH
        router.depositETH{value: amount}(amount, gasLimit);

        // skip message 0
        hevm.startPrank(address(rollup));
        messageQueue.popCrossDomainMessage(0, 1, 0x1);
        assertEq(messageQueue.pendingQueueIndex(), 1);
        hevm.stopPrank();

        uint256 balance = address(this).balance;

        // Router reverts as it cannot handle the hook call
	// Comment the following line when adding the router.onDropMessage() hook
        hevm.expectRevert(new bytes(0));
        l1Messenger.dropMessage(address(router), address(this), amount, 0, new bytes(0));

        // Passes when the hook is not implemented
        assertEq(balance, address(this).balance);

        // Passes with hook implemented
        // assertEq(balance + amount, address(this).balance);
	}
}

// ----------------------------

// Add the following lines to the Router contract to test it with a hook
contract L1GatewayRouter is OwnableUpgradeable, IL1GatewayRouter {

	// ...

	address internal user;
	
	// ...

	function depositETHAndCall(...) {

		// ...
	
		user = _msgSender();
	}

	// ...

	// Adding a simple hook to handle the refund
	function onDropMessage(bytes calldata _message) external payable virtual {
	    address _receiver = user;
	    (bool _success, ) = _receiver.call{value: msg.value}("");
	    require(_success, "ETH transfer failed");

	    emit RefundETH(_receiver, msg.value);
	}
}