ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Insufficient Validation for ERC721 Deployment

axicnode398

Description:
The ensure_erc721_deployment function checks if a collection is already deployed. However, if this check fails, it deploys a new collection without thoroughly verifying the input parameters.

Location: ensure_erc721_deployment function in apps/blockchain/starknet/src/bridge.cairo, from line 428 add validation checks in ensure_erc721_deployment.

Issue:
Without proper verification, an attacker could potentially manipulate the function to deploy a new collection with unintended parameters, leading to potential misuse or loss of control over assets.

Impact:
Unauthorized or incorrect deployments could lead to loss of assets or operational failures in the bridge.

Tools used: Manual Review.

Recommendations:
Add additional validation to ensure that the deployment of the ERC721 collection is done with verified and trusted parameters.

Potential changes:
Add assertions or validation logic to ensure the parameters for deployment are correct.

Add validation checks in ensure_erc721_deployment: self: ContractState, req: @Request) -> ContractAddress {
​
let l1_req: EthAddress = *req.collection_l1;
let l2_req: ContractAddress = *req.collection_l2;
​
let collection_l2 = verify_collection_address(
l1_req,
l2_req,
self.l2_to_l1_addresses.read(l2_req),
self.l1_to_l2_addresses.read(l1_req),
);
​
if !collection_l2.is_zero() {
return collection_l2;
}
​
// New: Validate deployment parameters
assert(!l1_req.is_zero(), 'Invalid L1 request address');
assert(!l2_req.is_zero(), 'Invalid L2 request address');
​
let hash = *req.hash;
let salt_data: Span<felt252> = array![hash.low.into(), hash.high.into()].span();
let salt = poseidon_hash_span(salt_data);
​
let l2_addr_from_deploy = deploy_erc721_bridgeable(
self.erc721_bridgeable_class.read(),
salt,
req.name.clone(),
req.symbol.clone(),
req.base_uri.clone(),
starknet::get_contract_address(),
);
​
self.l1_to_l2_addresses.write(l1_req, l2_addr_from_deploy);
self.l2_to_l1_addresses.write(l2_addr_from_deploy, l1_req);
​
self.emit(CollectionDeployedFromL1 {
l1_addr: *req.collection_l1,
l2_addr: l2_addr_from_deploy,
name: req.name.clone(),
symbol: req.symbol.clone()
});
​
if !self.white_listed_list.read(l2_addr_from_deploy).0 {
_white_list_collection(ref self, l2_addr_from_deploy, true);
self.emit(CollectionWhiteListUpdated {
collection: l2_addr_from_deploy,
enabled: true,
});
}
l2_addr_from_deploy
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.