ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Improper Handling of Deserialization Errors in `SpanFeltTryIntoByteArray` can lead to Unexpected Behavior (`byte_array_extra.cairo::SpanFeltTryIntoByteArray`)

4gontuk

Summary

Vulnerability Detail

The SpanFeltTryIntoByteArray implementation in the starknet/src/byte_array_extra.cairo contract is responsible for converting a span of felt252 elements into a ByteArray. This function is crucial for handling multiple felt252 elements and converting them into a single ByteArray representation. However, the function does not handle deserialization errors properly. If deserialization fails, the function does not return Option::None, which can lead to unexpected behavior or runtime errors.

Impact

The improper handling of deserialization errors can lead to unexpected behavior or runtime errors. Specifically, if deserialization fails, the function does not return Option::None, which can lead to incorrect ByteArray objects being created. This can affect any downstream logic relying on accurate conversions.

Tools Used

Manual review

Recommendation

The deserialization logic should be updated to handle deserialization errors properly. The following code provides a corrected implementation:

​
impl SpanFeltTryIntoByteArray of TryInto<Span<felt252>, ByteArray> {
fn try_into(self: Span<felt252>) -> Option<ByteArray> {
if self.len() == 0_usize {
Option::None(())
} else if self.len() == 1_usize {
(*self[0]).try_into()
} else {
let mut self = self.clone();
match Serde::deserialize(ref self) {
Ok(byte_array) => Option::Some(byte_array),
Err(_) => Option::None, // Handle deserialization errors
}
}
}
}

This fix ensures that deserialization errors are properly handled and the function returns Option::None if deserialization fails.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.