ArkProject: NFT Bridge

Summary

Users call depositTokens() function to bridge from L1 to starkent, and that function is payable i.e user should send some ETH along with the transaction. Problem is that the value required to call the sendMessageToL2() function on SnMessaging and also for the starknet sequencer to call the L1HandlerTransaction is something limited. Thus any excess sent by the user should be reimbursed to him but it is not.

In another report i recommended a good way to calculate the cost of bridging and enforce that the user sent at least the cost. While this is done, we should also reimburse any excess fee to the caller address.

Vulnerability Details

See the summary above

Impact

User Excess ETH sent for msg.value will be stuck inside the SnMessaging contract.

Tools Used

Manual review

Recommendations

Calculate the correct fees for bridging , enforce users sends at least the fee and reimburse any excess sent to him.

1. First use forge to calculate fee for storing msgHash inside Ethereum (This is done by the SnMessaging contract).

2. The fees of the L1HandlerTransaction are computed in a regular manner as it would be done for an Invoke transaction. For this, you can profile the gas consumption using starkli or snforge to estimate the cost of your message execution.

3. Total fee is the sum of the two fees.