ArkProject: NFT Bridge

Summary

If enable is false, the function still sets _whiteList[collection] = enable (false), but doesn't remove the collection from the _collections array. This can lead to an inconsistent state where a collection is in the array but not whitelisted.

Vulnerability Details

Here's the _whiteListCollection function:

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L340C4-L356C6

The problem arises when enable is falsein the whitelist function:

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L284C1-L287C6

Here's a breakdown:

When enable is false, the code inside the if (enable && !_whiteList[collection]) block is not executed. This means no changes are made to the _collections array.

• However, the last line _whiteList[collection] = enable; is always executed, regardless of the value of enable.

• So, when enable is false, this line effectively removes the collection from the whitelist by setting _whiteList[collection] to false.

• But crucially, it does not remove the collection's address from the _collections array since if (enable && !_whiteList[collection]) block is not executed.

This leads to an inconsistent state where:

• The collection is marked as not whitelisted in the _whiteList mapping (_whiteList[collection] = false)

• But the collection's address still remains in the _collections array

Impact

• Collection address won't be whitelisted but still exists in the _collections array

• It would be impossible to add a collection address, previously whitelisted and pushed into the collection array then removed from whitelist, back into the _collection array.

Tools Used

Manual review

Recommendations