ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Uninitialized Mappings in Cairo Serialization in Protocol.sol

heim

Summary

The requestSerialize function relies on the Cairo.cairoStringSerialize and potentially other Cairo-specific library functions, which may not initialize the required mappings properly.

Vulnerability Details

Uninitialized mappings or vectors used within these serialization functions can lead to incomplete or corrupted data, causing issues during message transfers.

Affected Code:

offset += Cairo.cairoStringSerialize(req.name, buf, offset);
offset += Cairo.cairoStringSerialize(req.symbol, buf, offset);
offset += Cairo.cairoStringSerialize(req.uri, buf, offset);

POC (Proof of Concept)

Consider a scenario where Bob and Alice attempt to serialize a request:

// Bob's Example
Request memory requestBob = Request({
header: Cairo.felt252Wrap(HEADER_V1 | ERC721_TYPE),
hash: 123,
collectionL1: address(0xB00B),
collectionL2: Cairo.snaddressWrap(0xCA10),
ownerL1: address(0xB0B0B0B0),
ownerL2: Cairo.snaddressWrap(0xB010),
name: "Bob's Collection",
symbol: "BOB",
uri: "http://example.com/bob",
tokenIds: new uint256[](2),
tokenValues: new uint256[](2),
tokenURIs: new string[](2),
newOwners: new uint256[](2)
});
uint256[] memory serializedBob = Protocol.requestSerialize(requestBob);
// Bob encounters an error if mappings are not properly initialized.
​
// Alice's Example
Request memory requestAlice = Request({
header: Cairo.felt252Wrap(HEADER_V1 | ERC1155_TYPE),
hash: 456,
collectionL1: address(0xA11C),
collectionL2: Cairo.snaddressWrap(0xE20),
ownerL1: address(0xA1A1A1A1),
ownerL2: Cairo.snaddressWrap(0xA110),
name: "Alice's Collection",
symbol: "ALC",
uri: "http://example.com/alice",
tokenIds: new uint256[](3),
tokenValues: new uint256[](3),
tokenURIs: new string[](3),
newOwners: new uint256[](3)
});
uint256[] memory serializedAlice = Protocol.requestSerialize(requestAlice);
// Alice encounters an error if mappings are not properly initialized.
​

An example scenario where uninitialized mappings cause the contract to malfunction:

Request memory request = Request({
header: Cairo.felt252Wrap(HEADER_V1 | ERC721_TYPE),
hash: 123,
// other fields initialized
});
// Serialize request
uint256[] memory serialized = Protocol.requestSerialize(request);
​

If Cairo.cairoStringSerialize does not handle uninitialized mappings correctly, this could corrupt the serialized data.

Impact

  • Severity: Medium

  • Data Corruption: Potential for serialized request data to be incomplete or corrupted.

  • Transaction Failures: Erroneous serialization can prevent successful message transfers and other operations.

Tools Used

  • Manual Code Review

Recommendations

  • Mapping Initialization: Ensure all mappings are initialized before they are used.

  • Robust Serialization: Add checks within Cairo.cairoStringSerialize to confirm that all necessary mappings or vectors are properly initialized.

Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.