ArkProject: NFT Bridge

Summary

Vulnerability Detail

The bridge.cairo contract implements a cross-chain token bridge between L1 and L2. One of its key functions, withdraw_auto_from_l1(), is responsible for processing withdrawal requests originating from L1. This function is crucial for maintaining the integrity and security of the bridge, as it handles the transfer or minting of tokens on L2 based on the information provided in the withdrawal request.

The withdraw_auto_from_l1() function takes two parameters: from_address (the L1 sender address) and req (the withdrawal request details). It first checks if the bridge is enabled and verifies that the from_address matches the stored bridge_l1_address. However, a critical security check is missing: the function does not verify the integrity of the req data by recomputing and comparing its hash.

The Request struct contains essential information such as token IDs, owner addresses, and URIs. Without proper hash verification, an attacker could potentially alter this data after it has been signed on L1 but before it reaches L2, leading to unauthorized withdrawals or minting of tokens.

This issue stems from an incomplete implementation, as evidenced by the TODO comment in the code:

The absence of these crucial checks opens up a significant security hole in the bridge's withdrawal process.

Relevant code:

Impact

An attacker could alter the request data and withdraw tokens they do not own, leading to significant financial losses for users of the bridge.

Proof of Concept

1. Alice initiates a legitimate withdrawal request on L1 to withdraw 10 tokens of ID 1234 to her address 0xAlice on L2.

2. The L1 contract signs this request and sends it to L2.

3. An attacker intercepts this request before it reaches the L2 withdraw_auto_from_l1() function.

4. The attacker modifies the req data, changing the owner_l2 to their address 0xAttacker and potentially altering the token_id or quantity.

5. The attacker submits this modified request to the withdraw_auto_from_l1() function.

6. The function processes the request without verifying the hash, resulting in the tokens being minted or transferred to the attacker's address instead of Alice's.

Tools Used

Manual review

Recommendation

To mitigate this issue, implement hash verification for the req data in the withdraw_auto_from_l1() function. This will ensure that the request data has not been tampered with after being signed on L1.

Here's a diff of the recommended changes:

You guys can also implement comprehensive validation for all fields in the req struct to ensure they conform to expected values and ranges. This may include checks for valid addresses, token IDs, and other relevant data.