WATCHPUG - The value of `to` parameter in `_bridgeTxData` can be malicious about 2022-10-mover-judging

[McMannaman]

There's additional validation steps for the event, that include also transaction matching on L1 and ensuring all the balances are in place before actual card topup occurs. Based from the description, though, if this event would be the only source of truth for the topup that would be a high severity.

[Evert0x]

From a pure solidity perspective it is not an attack vector if an event can be emitted with arbitrary calls. However, we like to take the business logic into account to a certain degree, but considering the protocol put the following text in their readme:

https://github.com/sherlock-audit/2022-10-mover/blob/main/cardtopup_contract/readme.md

The settlement process on L1 is off-chain and out of scope of the smart contracts.
If the proper event would be generated for card top-up, it would be further processed
by backend infrastructure.

We don't assign a medium or high severity to this issue.