ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Potential Misconfiguration in L1-L2 Collection Mapping

axicnode398

The setL1L2CollectionMapping function in the Starklane contract includes a force parameter that allows for overwriting existing mappings between L1 and L2 collections. While this can be useful, it also poses a risk if misused, leading to incorrect mappings that could result in asset loss.

Description: The force parameter in setL1L2CollectionMapping could be misused, leading to incorrect or unintended mappings, which might result in asset loss across L1 and L2.

Location:setL1L2CollectionMapping function in ethereum/src/IStarklane.sol

Issue: The setL1L2CollectionMapping function allows an L1 to L2 address mapping to be set with a force parameter. Misuse of this parameter could lead to unintended or incorrect mappings, potentially causing loss of assets.

Impact: Incorrect mappings could cause assets to be locked or lost across L1 and L2.

Tools used: Manual Review.

Recommendations: Ensure the force parameter in setL1L2CollectionMapping is used only when necessary and document its use to prevent misconfiguration.

Potential changes: To ensure this powerful feature is used responsibly, I added warnings and checks whenever the force parameter is used. This would help prevent accidental or malicious misconfiguration.

function setL1L2CollectionMapping(
address collectionL1,
snaddress collectionL2,
bool force
) external onlyOwner {
if (force) {
emit Warning("Force flag is being used. Ensure this is intended.");
}
​
_setL1L2AddressMapping(collectionL1, collectionL2, force);
emit L1L2CollectionMappingUpdated(collectionL1, snaddress.unwrap(collectionL2));
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.