ArkProject: NFT Bridge
ArkProject
Submission Details
Severity: low
InvalidNonce is not included in message consumption from L2, this can cause replay attack or hash collision when users consume messages from L2
Updates
Lead Judging Commences
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:
invalid-replay-attack-hash-not-stored-nonce-not-used
There is no impact here: Transaction cannot be replayed because the blockchain use the nonce in the signature. Hash is computed on-chain. Using or trying to have the same hash mean you need to buy the token, and they will be sent to their origin owner. Why an attacker would buy tokens to give them back ? No real impact.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
High Medium
50,000 USDC
Low
5,500 USDC
Judges
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Community Judging
Submissions are being reviewed by the community.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.