ArkProject: NFT Bridge

Summary

The function _isWhiteListed is intended to check if a collection is whitelisted when the whitelist feature is enabled. However, there is a logical error in the implementation, which could lead to incorrect access control.

Vulnerability Details

The current implementation of _isWhiteListed is as follows:

The logic checks if the whitelist is disabled (!_whiteListEnabled) or if the collection is in the whitelist (_whiteList[collection]). This results in collections being considered whitelisted even when _whiteListEnabled is set to true, as long as _whiteListEnabled is false. This behavior is incorrect; the correct logic should enforce that both the whitelist is enabled and the collection is present in the whitelist:

Impact

This issue can lead to unauthorized collections being treated as whitelisted, potentially allowing unauthorized access to the bridge.

Tools Used

Manual code review.

Recommendations

Modify the logic in the _isWhiteListed function to ensure that a collection is considered whitelisted only when the whitelist is enabled and the collection is present in the whitelist.