ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Pausability

kwakudr

Summary

The contract does not appear to have a mechanism to pause its operations in case of emergencies or when critical updates are needed. This is a significant concern for a bridge contract that handles valuable assets and operates between two different blockchain networks.

Vulnerability Details

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L44C5-L66C6

function initialize(
bytes calldata data
)
public
onlyInit
{
(
address owner,
IStarknetMessaging starknetCoreAddress,
uint256 starklaneL2Address,
uint256 starklaneL2Selector
) = abi.decode(
data,
(address, IStarknetMessaging, uint256, uint256)
);
_enabled = false;
_starknetCoreAddress = starknetCoreAddress;
​
​
_transferOwnership(owner);
​
​
setStarklaneL2Address(starklaneL2Address);
setStarklaneL2Selector(starklaneL2Selector);
}

If a vulnerability is discovered, there's no quick way to stop users from interacting with the contract, potentially putting their assets at risk.

When deploying upgrades or making significant changes to the system, it's often necessary to temporarily halt operations.

If there are problems with either the Ethereum network or the Starknet network, it might be necessary to pause operations to prevent inconsistent state or lost transactions.

Impact

There will be significant losses of funds when the unforseen happens

Tools Used

Manual Review

Recommendations

Add the pause and unpause modifier to critical functions. This Provides options for handling various unforeseen circumstances that may arise in the future.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!