ArkProject: NFT Bridge

Summary

In the depositTokens function, the sendMessageToL2 call allows a user to send a message with a msg.value of 0, which might lead to unexpected behavior if a non-zero msg.value is required for gas.

Vulnerability Details

There is no check to ensure that msg.value is greater than 0. If a non-zero msg.value is required to cover gas costs or other expenses, this could lead to failed transactions or other issues.

Impact

Users might unintentionally send a transaction with insufficient funds, leading to failed L2 messaging and potential loss of user funds due to gas costs on L1.

Tools Used

Manual code review.

Recommendations

Implement a check to ensure that msg.value is appropriate for the transaction, or provide guidance to users on the required msg.value for successful execution.