ArkProject: NFT Bridge

Summary

The L1 Bridge contract uses sendMessageToL2 to communicate between Mainnet and Starknet, however there is no validation concerning the price of sent messages, which can result in tokens stuck on the bridge due to the failure to mine underpriced transactions.

Vulnerability Details

When invoking sendMessageToL2, the msg.sender must send a sufficient msg.value to cover the cost of bridging:

However, the bridge does not impose a sane minimum fee.

It is rational that some callers should attempt to minimize fees, which can result in stuck message payloads which lack insufficient incentive to be processed.

Similarly, gas prices flucutations can impact upon the liveness of the bridge.

Invariably, this can result in tokens escrowed onto the bridge failing to be realized at the destination L2 due to the transaction being underpriced:

The transaction must have a correct payable amount: the invoked function costs roughly 3000 gas, so you should set msg.value around 3000*gas_price.

Impact

Whilst an underpriced transaction is pending, the tokens on the bridge will become stuck until the request is manually cancelled by the protocol owner.

Cancelling tokens is a manual two-phase process which must be endured by the protocol owner.

Tools Used

Manual Review

Recommendations

It is advised to recommend a minimum feePerGas for transmitting bridge messages and have this configurable by onlyOwner to ensure payloads have a significant chance of being eventually realized.