ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Front-Running and Replay Attacks

asar

Summary

The contract mentions a TODO about preventing replay attacks by storing request hashes in storage, but not implimented. Implement request hash checks to prevent replays.

Vulnerability Details

Lack of request hash storage allows replay attacks.

Request memory req;
​
// The withdraw auto is only available for request originated from
// Starknet side as the withdraw on starknet is automatically done
// by the sequencer.
req.header = Protocol.requestHeaderV1(ctype, useAutoBurn, false);
req.hash = Protocol.requestHash(salt, collectionL1, ownerL2, ids);
// TODO: store request hash in storage to avoid replay attack.
// or can it be safe to use block timestamp? Not sure as
// several tx may have the exact same block.
req.collectionL1 = collectionL1;
req.collectionL2 = _l1ToL2Addresses[collectionL1];
​
req.ownerL1 = msg.sender;
req.ownerL2 = ownerL2;
​
// ... (rest of the function)
}

Impact

Tools Used

Manual code review

Recommendations

To resolve this issue, the developer should uncomment the suggested fix and implement a system to store and check request hashes. This could involve:

  1. Storing the request hash in storage when a new request is made.

  2. Checking if a request hash has been seen before for the current sender before processing a new request.

For example:

mapping(address => mapping(uint256 => bytes32)) private requestHashes;
​
function depositTokens(...) external payable {
// ... (existing code)
​
Request memory req;
// ... (existing code)
​
// Store the request hash in storage
requestHashes[msg.sender][salt] = keccak256(abi.encodePacked(req));
​
// ... (rest of the function)
}
​
function processRequest(bytes calldata request) external payable {
// Check if the request hash has been seen before
bytes32 requestHash = keccak256(abi.encodePacked(request));
require(!requestHashes[msg.sender].contains(requestHash), "Replay attack detected");
​
// Process the request
// ... (existing code)
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid-replay-attack-hash-not-stored-nonce-not-used

There is no impact here: Transaction cannot be replayed because the blockchain use the nonce in the signature. Hash is computed on-chain. Using or trying to have the same hash mean you need to buy the token, and they will be sent to their origin owner. Why an attacker would buy tokens to give them back ? No real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.