Lack of Input Validation in Bridge contract
Hello Arkproject,
Functions like depositTokens and withdrawTokens rely on input parameters such as ids, ownerL2, and collectionL1. If these inputs are not properly validated, they could lead to unexpected behavior or exploitation. For instance, an invalid or malicious collectionL1 address could cause the contract to interact with unintended or malicious contracts.
Mitigation: Implement thorough input validation to ensure that addresses, token IDs, and other parameters are within expected ranges and conform to expected formats.
Lead Judging Commences
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.