ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

There is no access control on the init function

arnie

Summary

There is no access control on the init function

Vulnerability Details

the init function is missing access control allowing any user to front run the owner and set himself as owner of the contract.

function initialize(bytes calldata data) public onlyInit {
(
address owner,
IStarknetMessaging starknetCoreAddress,
uint256 starklaneL2Address,
uint256 starklaneL2Selector
) = abi.decode(data, (address, IStarknetMessaging, uint256, uint256));
_enabled = false;
_starknetCoreAddress = starknetCoreAddress;
​
_transferOwnership(owner);
​
setStarklaneL2Address(starklaneL2Address);
setStarklaneL2Selector(starklaneL2Selector);
}

above we can see the init function of the contract bridge.sol, the init function has a single modifier named onlyInit Let us take a look at the code of this modifier below.

modifier onlyInit() {
address impl = _getImplementation();
require(!_initializedImpls[impl], "Already init");
_initializedImpls[impl] = true;
​
_;
}

As we can see the modifier above only checks if the impl has already been initialized, if not we continue code execution. Therefore since there is no real access control on who can can the initialize function, this function can be called by anyone and they will be set as the owner.

Line of Code

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L44

Impact

Malicious user can take ownership of the contract

Tools Used

manual reveiw

Recommendations

ensure only he correct owner can initialized the contract but having stricter access control on the function.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.