ArkProject: NFT Bridge

Summary

If the user sets use_withdraw_auto to true in the cross-chain of L2->L1, then these cross-chain NFTs will be stuck forever.

Vulnerability Details

background:

1. When the user calls the deposit_tokens function to cross-chain the NFT from L2 to L1, the use_withdraw_auto parameter can be set. If this parameter is set to true, the transaction will be executed successfully and cross-chain messages will be sent normally.

2. I don’t see anywhere where I can cancel cross-chain messages from L2->L1.

3. When the user calls the withdrawTokens function on L1 to withdraw the NFT, the protocol does not support withdraw_auto and will be revert directly.

   if (Protocol.canUseWithdrawAuto(header)) {

   // 2024-03-19: disabled autoWithdraw after audit report

   // _consumeMessageAutoWithdraw(_starklaneL2Address, request);

   revert NotSupportedYetError();

Therefore, if the user sets use_withdraw_auto to true, the user's NFT will always be stuck in the protocol and cannot be withdrawn. This is not foreseeable as cross-chain calls will execute normally. The problem will occur after the L2 block is verified in L1 (that is, 3 to 4 hours later). And there is no way to cancel cross-chain calls.

Since funds face the risk of being locked, I judge the impact to be High. Possibility is Med. So the risk level is H/M.

Impact

The user's NFT may be stuck in L2's bridge contract.

Tools Used

manual

Recommendations

When the user sets use_withdraw_auto to true, revert in L2.