ArkProject: NFT Bridge

Summary

Some users would either lose funds when attempting to bridge, or have their tx potentially stuck.

Vulnerability Details

Inorder to bridge the NFTs the Bridge#depositTokens(), function is called, which is marked as payable so as to provide the fee for processing this transaction on StarkNet.

Now would be key to note that messaging on StarkNet is not like the common cross chain messaging via layerZero fee wise, i.e here there is no refundAddress where excess fees get sent to and the exact fee is expected to be passed when querying StarknetMessaging#sendMessageToL2().

This is also known to the Starknet team which is why, they've included this section in their docs: https://docs.starknet.io/architecture-and-concepts/network-architecture/messaging-mechanism/#l1-l2-message-fees.

Where they've indicated that to get the exact fees, it's advisable to use the CLI to get an estimate of an L1 → L2 message fee.

Now since this is not being done in the Ark bridge, this opens up two windows:

Naturally we don't expect users to guess right down to the wei value how much their tx would cost, so users would then:

• If trying to pay cheap, would pass in a less than amount for fees, which would have their bridging attempt on starkNet fail, and they then have to be DOS'd from their tokens till the request is canceled on starknet (which takes a minimum of 5 days to finalize), since during the initial attempt at bridging the tokens were deposited into an escrow.

• If trying to ensure their tx always passes, they then would pay a very high fee, but less than the MAX_L1_MSG_FEE which is currently 1 ether.

Impact

As hinted under Vulnerability Details, the bridging process is quite flawed when considering it's feeing logic since we can't expect users to guess right down to the wei value how much their tx would cost on starkNet, and would have either their attempt revert (after already speding native ethereum gas fees placing in these requests), or them losing out on funds due to overpaying the fees.

Tools Used

Manual review

Recommendations

Use the recommendations both in Starknet's docs and the official Cairo book which in our case would be to incorporate checking the fee on the CLI to get an estimate fee for the bridging tx and request users pay this.