ArkProject: NFT Bridge

Summary

The withdrawTokens function in the Starklane bridge contract allows an attacker to deploy and whitelist an arbitrary ERC721 collection on L1 by exploiting the collection deployment logic when no corresponding L1 collection exists for a given L2 collection.

Vulnerability Details

The vulnerability exists in the withdrawTokens function:

• The function allows processing a request with an empty tokenIds array.

• If collectionL1 is address(0), it deploys a new ERC721 collection using parameters from the request.

• The newly deployed collection is automatically whitelisted.
  An attacker can craft a request with:

• A non-existent L2 collection address

• Empty tokenIds array

• Arbitrary name and symbol

Impact

This allows the attacker to deploy and whitelist an arbitrary ERC721 collection on L1 without proper authorization.

• Unauthorized Collection Deployment: An attacker can deploy arbitrary ERC721 collections on L1.

• Whitelist Manipulation: These deployed collections are automatically whitelisted, potentially bypassing security checks.

• Bridge Integrity Compromise: This could lead to a mismatch between L1 and L2 collections, compromising the bridge's integrity.

• Potential for Further Exploits: The attacker-controlled L1 collection could be used for additional malicious activities.

Tools Used

Manual

Recommendations

Require Non-Empty Token IDs: Ensure that the tokenIds array is not empty in the withdrawTokens function.
solidityCopyrequire(req.tokenIds.length > 0, "Token IDs array cannot be empty");

Separate Collection Deployment: Move the collection deployment logic to a separate function that requires proper authorization (e.g., only callable by the contract owner or a trusted role).