Summary

The Starklane bridge contract has a critical issue in its whitelist logic. When the whitelist is disabled (_whiteListEnabled is set to false), the isWhiteListed function returns true for all collections. This effectively means that all collections are treated as whitelisted, allowing any collection to be deposited into the bridge. This behavior can lead to unauthorized deposits and potential security risks.

Proof of Concept

Coded POC

Vulnerability Details

The issue arises from the implementation of the isWhiteListed function, which checks the _whiteListEnabled state variable to determine if the whitelist feature is currently enabled. If _whiteListEnabled is false, the function returns true for any collection, effectively bypassing the whitelist restrictions.

In the current implementation:

Test Results Analysis of Whitelist Logic Inversion Issue

Step 1: Setup and Initialization

Action: The setUp() function initializes the Starklane contract and other dependencies.

• Evidence:

  • The Starklane contract is deployed.

  • The initialize() function is called, setting the initial state.

Step 2: Check Whitelist Status (Initially Enabled)

Action: The test calls isWhiteListEnabled() to check if the whitelist is enabled.

• Evidence:

  • The function returns true, confirming the whitelist is initially enabled.

Step 3: Verify Whitelisted Collection

Action: The test checks if the Whitelisted collection is correctly whitelisted.

• Evidence:

  • The function returns true, confirming the collection is correctly whitelisted.

Step 4: Verify Non-Whitelisted Collection

Action: The test checks if the NonWhitelisted collection is not whitelisted.

• Evidence:

  • The function returns false, confirming the collection is not whitelisted.

Step 5: Disable Whitelist

Action: The test disables the whitelist by calling enableWhiteList(false).

• Evidence:

  • The WhiteListUpdated event is emitted with enable: false.

  • The whitelist is now disabled.

Step 6: Verify Whitelist is Disabled

Action: The test verifies that the whitelist is disabled.

• Evidence:

  • The function returns false, confirming the whitelist is disabled.

Step 7: Check Whitelisted Collection After Disabling Whitelist

Action: The test checks if the Whitelisted collection is still whitelisted after disabling the whitelist.

• Evidence:

  • The function incorrectly returns true. Even though the whitelist is disabled, the logic should not imply that the collection remains whitelisted.

Step 8: Check Non-Whitelisted Collection After Disabling Whitelist

Action: The test checks if the NonWhitelisted collection is whitelisted after disabling the whitelist.

• Evidence:

  • The function incorrectly returns true. This shows that disabling the whitelist inadvertently allows all collections to bypass the whitelist check.

Step 9: Attempt to Deposit Non-Whitelisted Token

Action: The test attempts to deposit a token from the NonWhitelisted collection.

• Evidence:

  • The deposit operation is performed, but it should fail since the collection is not supposed to be whitelisted after disabling the whitelist.

Final Step: Failure Due to Logic Inversion

Action: The transaction reverts.

• Evidence:

  • The revert indicates an issue with the whitelist logic, as the test expects the deposit to fail due to the collection not being whitelisted.

The test results clearly indicate a logic inversion issue with the whitelist. When the whitelist is disabled, all collections are incorrectly treated as whitelisted, which is not the intended behavior.

Impact

1: The issue allows any token to be bridged when the whitelist is disabled, potentially including malicious or incompatible tokens.

2: The issue is easily exploitable once the whitelist is disabled.

Tools Used

Recommendations

1: Revise Whitelist Logic: Modify the isWhiteListed function to return false for all collections when the whitelist is disabled, unless explicitly required otherwise

2: Add a separate flag or mechanism to allow unrestricted bridging if that functionality is needed, rather than relying on the whitelist disable feature.