fix(protocol): check no loops in multi-hop in Bridge

[dantaik]

This PR mitigates the concerns in this issue , but I'm having a hard time to construct an exploiting attack transaction with a bridge loop that has security impact.

[openzeppelin-code]

fix(protocol): check no loops in multi-hop in Bridge

Generated at commit: f4906ee6e6ea45db40d1c2ee188ebb69efd23887

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	2 2 0 3 39 46
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

---

For more details view the full report in OpenZeppelin Code Inspector

[adaki2004]

Thinking thru, i think it is possible to embeded signals, but i dont think there is a security concern here because of 2 reasons:

• In order to be malicious you need to somewhat "mock" a call to SignalService on behalf of the Bridge -> otherwise the sendSignal() will use a different slot _sendSignal(msg.sender, _signal, _signal). So you definitely can call SignalService sendSignal, but later during verification the slot is always used with one of the Bridge contracts (so proof will be invalid).
• For app we always use our own address signalService = resolve(chainId, "signal_service", false);

So given the 2 factors, i dont think a self-referential hop is safety critical.

[dantaik]

Thinking thru, i think it is possible to embeded signals, but i dont think there is a security concern here because of 2 reasons:

• In order to be malicious you need to somewhat "mock" a call to SignalService on behalf of the Bridge -> otherwise the sendSignal() will use a different slot _sendSignal(msg.sender, _signal, _signal). So you definitely can call SignalService sendSignal, but later during verification the slot is always used with one of the Bridge contracts (so proof will be invalid).
• For app we always use our own address signalService = resolve(chainId, "signal_service", false);

So given the 2 factors, i dont think a self-referential hop is safety critical.

I tend to agree, but TBH, preventing loops makes me feel more comfortable given the cost is really small.