cancelRequest can be called when bridge is disabled
Summary
cancelRequest is a function that can be called by anyone, only if the owner has marked the request as canceled and the safe period (5 days) has passed. But then it can be invoked even when the bridge is disabled.
Vulnerability Details
cancelRequest is missing the following check, which allows it to be fired even when the bridge is disabled.
Impact
Owner might stop bridge for some important reason, such as some exploit exposure. But even then, the user can cancel the request, which will result in the NFT being withdrawn from escrow.
Tools Used
Manual Review
Recommendations
Add missing check. When bridge is disabled it's better to block all the actions.
Lead Judging Commences
invalid-cancel-when-bridge-disable
Technically, if you cancel a message, the token is not really bridged. If you can withdraw, it means that the token has already been bridged. Those two funtions do not have to be disable when the bridge is. Moreover nothing should prevent users to get back their NFT.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.