ArkProject: NFT Bridge

Summary

The depositTokens function in the Bridge.sol contract sends a message to the Starknet layer 2 via IStarknetMessaging.sendMessageToL2. The issue arises because the function does not calculate the required fees for sending the message, leading to a situation where users can send excess funds and lose them in fees. This can result in users overpaying and losing funds unnecessarily.

Vulnerability Details

The relevant code snippet from the depositTokens function is:

In this code, the function sends the entire msg.value as the fee for sending the message to Starknet, without calculating the exact fee required. As a result, users might inadvertently send more ETH than necessary, leading to loss of funds.

Proof of Concept (PoC)

Consider a scenario where a user sends 1 ETH as fees, which is excessive for the operation:

In this test, the user pays 1 ETH for fees, which is more than necessary. Since the function does not calculate or refund the excess, the user loses the excess amount.

Impact

• Loss of Funds: Users may overpay the fee, resulting in unnecessary loss of funds.

Tools Used

• Manual Review

• Foundry (for testing PoC)

Recommendations

1. Implement Fee Calculation: The contract should calculate the exact fee required for sending the message to Starknet. This can be done by querying the Starknet messaging contract for the required fee or implementing a fee estimation mechanism.

Conclusion

The depositTokens function in Bridge.sol currently does not properly calculate the fees required for sending a message to Starknet, leading to potential overpayment and loss of funds for users. By implementing a fee calculation mechanism and refunding excess fees, the contract can prevent unnecessary losses and improve user experience.