ArkProject: NFT Bridge

Summary

The TokenUtil.detectInterface() function identifies NFTs that support both ERC721 and ERC1155 standards as CollectionType.ERC721, and the StarklaneEscrow::_escrow(collectionAddres => (tokenId => depositor)) mapping tracks only one tokenId per depositor, this can lead to NFT tokens, such as Sandbox's ASSETs, will be locked when bridged between L1 and L2.

Vulnerability Details

The bridge's collection whitelist could be disabled by the enableWhiteList() function, so after the whitelist is disabled, it is possible for a user to bridge tokens that support both ERC721 and ERC1155 standards, such as the Sandbox's ASSETs.

The Sandbox's ASSETs ERC1155ERC721.supportsInterface supports both ERC721 and ERC1155 interfaces:

As the TokenUtil.detectInterface() function identifies the type of these NFTs as CollectionType.ERC721, bridging Sandbox's ASSETs from L1 to L2 will transfer one item each time.

In the StarklaneEscrow._depositIntoEscrow() function, when multiple users attempt to bridge the same Sandbox ASSET (identified by the same tokenId), the function sets _escrow[collection][id] = msg.sender. This causes the _escrow mapping to update the owner of the token to the last user who bridged the ASSET with that tokenId.

For instance, if User A bridges a Sandbox ASSET with tokenId = 123, _escrow[collection][123] is set to User A. Later, if User B bridges the same tokenId = 123, _escrow[collection][123] is overwritten, now showing User B as the owner. This results in the original owner, User A, losing ownership of the token.

Impact

If bridge whitelist is disabled or NFT tokens support both ERC721 and ERC1155 standards are whitelisted, bridge users' token will cause tokens to be locked.

Tools Used

vscode

Recommendations

The TokenUtil.detectInterface() function should check if a collection is ERC1155 first.