ArkProject: NFT Bridge

Summary

The withdrawTokens function in the provided contract deserializes withdrawal requests using Protocol.requestDeserialize without performing any validation on the request's format or contents. This lack of validation can lead to unexpected behavior or vulnerabilities, potentially allowing malicious actors to exploit the deserialization process for unauthorized token withdrawals or other manipulations.

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L177

Vulnerability Details

The withdrawTokens function directly invokes Protocol.requestDeserialize on the input request without validating its format or contents. This deserialization process lacks sufficient safeguards against malformed or manipulated requests, which could be used to exploit the contract.

The above code illustrates that the withdrawTokens function relies on Protocol.requestDeserialize to process the incoming request. However, no validation occurs before or after deserialization to ensure that the request adheres to expected formats or contains valid data.

Impact

The primary impact of this vulnerability is the potential for unauthorized token withdrawals. If a malicious actor crafts a specially formatted request that exploits the deserialization process, they may be able to:

• Withdraw tokens they do not own.

• Manipulate the mapping between L1 and L2 collections.

• Carefully crafted malicious input could potentially cause the function to revert, leading to a denial of service for legitimate withdrawal requests.

Tools Used

Manual review

Recommendations

1: Add checks to ensure the request array has the expected length.

2: Validate each field of the deserialized request to ensure it contains expected and reasonable values.

3: After deserialization, add sanity checks on critical fields like token IDs, addresses, and amounts.

4: Wrap the deserialization in a try-catch block to handle any exceptions that might be thrown during the process.

5: Consider implementing limits on the number of tokens that can be processed in a single request to mitigate potential DoS attacks.