ArkProject: NFT Bridge

Summary

Starknet doesn’t ensure that values that are valid now, won’t be changed in the future, so having MAX_PAYLOAD_LENGTH as a constant can make the Bridge contracts less functional in case payload size gets modified.

Vulnerability Details

Looking at the Starknet docs, in the table with current limits we will see the following sentence:

These are subject to revisions and change on a regular basis

But the Bridge contract has no setter function for the max payload length, leading to future issues. The biggest impact will be caused if the max payload is decreased by Starknet. Valid depositTokens will lead to failed transactions and NFTs will be locked in the bridge contract. This will happen with each transaction with a payload bigger than the current limit on Starknet but lower than MAX_PAYLOAD_LENGTH.

The other way around is when payload size is increased, then MAX_PAYLOAD_LENGTH will prevent users with a lot of tokens from bridging them to L2 while this request is now valid and will force them to pay more bridge fees by executing multiple bridge transactions.

Bridge.sol

Impact

Less functional bridge when payload size is updated from Starknet, due to using hardcoded MAX_PAYLOAD_LENGTH variable

Tools Used

Manual Review

Recommendations

Add setter function for the max payload length and modify it when Starknet modifies it as well.