ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Risk During Token Escrow Operations

axicnode398

Description:
In the escrow_deposit_tokens function, tokens are transferred using the transfer_from method. If the contract interacting with this function has a custom onERC721Received function, it could reenter the function and cause unexpected behaviours.

Location: escrow_deposit_tokens function in blockchain/starknet/src/bridge.cairo line 402 -Add a reentrancy guard in the escrow_deposit_tokens function.

Issue:
The function does not protect against reentrancy attacks, which could allow an attacker to reenter the contract and manipulate state or perform multiple token transfers.

Impact:
A reentrancy attack could lead to unauthorized withdrawals or duplication of tokens, causing significant financial losses.

Tools used: Manual Review.

Recommendations:
Implement a reentrancy guard using a flag or a mutex-like mechanism to prevent reentrant calls.

Potential changes:
Add a reentrancy guard to the escrow_deposit_tokens function.

#[storage]
struct Storage {
// Existing storage variables...
​
// New: Reentrancy guard flag
reentrancy_guard: bool,
}
​
fn escrow_deposit_tokens(
ref self: ContractState,
contract_address: ContractAddress,
from: ContractAddress,
token_ids: Span<u256>,
) {
// New: Reentrancy guard check
assert(!self.reentrancy_guard, 'Reentrant call detected');
self.reentrancy_guard = true;
​
let to = starknet::get_contract_address();
let erc721 = IERC721Dispatcher { contract_address };
​
let mut i = 0_usize;
loop {
if i == token_ids.len() {
break ();
}
​
let token_id = *token_ids[i];
erc721.transfer_from(from, to, token_id);
self.escrow.write((contract_address, token_id), from);
i += 1;
};
​
// New: Reentrancy guard reset
self.reentrancy_guard = false;
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.