ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Critical Loss of Transaction Traceability and Cancellation Capability

salem

Summary

The depositTokens function in the Bridge contract fails to capture and store the nonce and msgHash returned by the sendMessageToL2 function. This omission severely impacts the ability to manage and cancel cross-chain transactions.

This is because the nonce is used a parameter to cancel a txn.

function cancelRequest(
uint256[] memory payload,
>> uint256 nonce @audit // There is no place for a user to get the nonce.
) external {

https://github.com/Cyfrin/2024-07-ark-project/blob/main/apps/blockchain/ethereum/src/Bridge.sol#L238-#L256

Vulnerability Details

When a user depositTokens to the L2

The depositTokens function calls sendMessageToL2 but it doesn't store the returned nonce and msgHash.

This is a critical oversight.

  • No event is emitted containing the nonce and msgHash for future reference.

  • Implications for Cancellation: The startRequestCancellation function requires the nonce as a parameter, which is not available due to this oversight. This effectively renders the cancellation feature unusable.

Impact

  • Users cannot cancel initiated deposits, potentially leading to locked funds.

  • Loss of transaction traceability between L1 and L2.

Tools Used

Manual Review

Recommendations

Modify the depositTokens function to capture and store the nonce and msgHash

(bytes32 msgHash, uint256 nonce) = IStarknetMessaging(_starknetCoreAddress).sendMessageToL2{value: msg.value}(
snaddress.unwrap(_starklaneL2Address),
felt252.unwrap(_starklaneL2Selector),
payload
);
​
// Store nonce and msgHash (implementation depends on your storage strategy)
_storeDepositDetails(req.hash, nonce, msgHash);
​
emit DepositRequestInitiated(req.hash, block.timestamp, payload, nonce, msgHash);
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.