ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Critical Input Validation in Contract Initialization

axicnode398

Description:
The constructor function initializes key contract variables but does not validate inputs like bridge_admin, bridge_l1_address, and erc721_bridgeable_class.

Location: constructor function in apps/blockchain/starknet/src/bridge.cairo, from line - 89 in the constructor function.

Issue:
Without validation, there’s a risk of initializing the contract with incorrect or malicious addresses, which could compromise the contract’s functionality.

Impact:
Improper initialization could lead to unauthorized control over the contract or malfunctioning of the bridge.

Tools used: Manual Review.

Recommendations:
Add validation checks to ensure that the addresses passed to the constructor are valid non-zero addresses.

Potential changes:
Add assert statements to the constructor to validate the inputs.

#[constructor]
fn constructor(
ref self: ContractState,
bridge_admin: ContractAddress,
bridge_l1_address: EthAddress,
erc721_bridgeable_class: ClassHash,
) {
// New: Validation of inputs
assert(!bridge_admin.is_zero(), 'Invalid bridge admin address');
assert(!bridge_l1_address.is_zero(), 'Invalid bridge L1 address');
assert(!erc721_bridgeable_class.is_zero(), 'Invalid ERC721 class hash');
​
self.ownable.initializer(bridge_admin);
self.bridge_l1_address.write(bridge_l1_address);
self.erc721_bridgeable_class.write(erc721_bridgeable_class);
self.white_list_enabled.write(false);
self.enabled.write(false); // disabled by default
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.