Check for the msg.value
provided to Bridge::depositTokens
is missing and users can perform free bridging since L2 sequencer picking every transaction no matter how much gas is used.
Also there is a note in the Cairo docs saying that minimum 20k wei must be forwarded in order to bridge successfully:
It's important to note that we have
{value: msg.value}
. In fact, the minimum value we've to send here is20k wei
, due to the fact that theStarknetMessaging
contract will register the hash of our message in the storage of Ethereum.In addition to those
20k wei
, since theL1HandlerTransaction
executed by the sequencer is not tied to any account (the message originates from L1), you must also ensure that you pay enough fees on L1 for your message to be deserialized and processed on L2.
Not providing enough gas fees to the depositTokens
will lead to either users bridging for free or when fees are enforced from the sequencer transactions providing less than 20k wei to fail.
The consequence of this actions are that NFTs will not be able to be bridged and will be locked in the bridge until the transactions is cancelled, but cancellation consists of two steps and the first one - Bridge::startRequestCancellation
have onlyOwner
modifier.
Not everyone will be able to cancel his failed transaction until the admin doesn’t cancel them, and if there are a lot of failing transaction that should be canceled this can lead to prolonged periods of locked tokens for the users.
Additionally, since depositTokens
allows users to bridge multiple tokens, the gas to be provided must be scaled based on the number of NFTs deposited.
Prolonged locked NFTs due to not enforcing minimum gas forwarded to depositTokens
.
Manual review
Introduce a minimum gas variable with an admin setter and scale it based on the amount of NFTs deposited. This value can be obtained by testing on a testnet how much gas will cost for 1 NFT and then scaled. Also add 20k wei as a buffer as suggested in the docs.
Something like this:
Impact: Medium/High. Need an admin to start a cancellation and wait for 5 days once done. DoS > 5 days. Likelyhood: Low. Everytime a wallet/or a user do not send enough gas
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.